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FOREWORD 


Flight  control  technology  passed  several  milestones  in  1973  with  the  successful 
flight  testing  of  two  pure  fly-by-^vire  systems— the  NASA  F-8  digital  fly-by-wire 
system  and  the  Air  Force  F-4  survivable  flight  control  system.  The  emergence  of 
these  highly  reliable  fly-by-wire  systems  makes  it  possible  to  consider  a stronger 
reliance  on  automatic  control  systems  for  the  design  optimization  of  future  air  trans- 
ports. By  including  specialists  in  flight  control  systems  in  the  preliminary  design 
process,  as  well  as  specialists  in  aerodynamics,  structures,  and  propulsion,  the 
synergistic  effect  of  the  integrated  design  can  be  exploited  to  an  extent  not  possible 
previously . This  design  philosophy  has  been  referred  to  as  the  control-configured 
vehicle  approach  or  the  application  of  active  control  technology  . Significant  payoffs 
can  be  expected  in  terms  of  improved  performance , longer  aircraft  life,  reduced 
fuel  consumption,  reduced  noise,  and  greater  passenger  comfort.  Several  studies 
and  flight  tests  sponsored  by  the  Air  Force  Flight  Dynamics  Laboratory  and  NASA 
demonstrated  the  potential  of  control-configured  vehicles  and  active  control  tech- 
nology. 

A symposium  on  advanced  control  technology  was  sponsored  by  NASA  to  discuss 
recent  advances  in  control  technology  and  the  impact  they  should  have  on  future 
transport  aircraft.  The  technical  papers  presented  discussed  work  performed  by 
government  and  industry  . The  topics  covered  included  the  flight  test  results  of 
advanced  control  technology  programs,  such  as  fly  by  wire,  digital  control,  and 
control-configured  vehicles;  the  application  of  advanced  control  systems  to  such 
vehicles  as  the  space  shuttle  arbiter,  the  Lockheed  C-5A  airplane,  and  the  Boeing 
B-747  airplane;  advanced  and  integrated  propulsion  control  systems;  and  case 
studies  of  the  benefits  of  applying  active  control  technology  to  transport  aircraft. 
Also  included  are  papers  on  the  design,  testing,  and  reliability  of  advanced  control 
systems,  which  are  directed  primarily  toward  the  technical  specialist, 

A high  point  in  the  symposium  was  a panel  discussion  concerning  the  applica- 
tion of  active  controls  to  future  transport  aircraft,  in  which  representatives  of  NASA, 
the  Air  Force,  the  FAA,  the  airlines,  and  aircraft  manufacturers  participated. 


Herman  A . Rediess 
Symposium  Technical  Chairman 
July  11,  1974 
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NASA  ADVANCED  CONTROL  TECHNOLOGY: 


AN  OVERVIEW 

Peter  R . Kurzhals 
NASA  Headquarters 

ABSTRACT 

NASA's  current  and  projected  advanced  control 
technology  programs  for  future  transport  aircraft  include 
the  design  and  verification  of  full-flight  envelope 
autopilots,  the  development  and  flight  test  of  all- 
digital  fly-by-wire  systems,  the  evolution  of  low-cost 
innovative  avionics  concepts  such  as  split  surface 
stability  augmentation  systems,  the  evaluation  of 
integrated  propulsion  control  and  cooperative  autopilot/ 
propulsion  control  systems,  the  application  of  active 
control  systems  to  short-haul  and  long-haul  transports, 
and  the  demonstration  of  reconfigured  active-control 
aircraft.  Key  technical  features  and  anticipated 
contributions  of  these  technologies  are  outlined. 

INTRODUCTION 

With  the  advent  of  digital  microelectronics,  practical 
design  of  a new  class  of  transport  aircraft  with 
significant  performance  gains  and  weight  savings  through 
active  controls  has  become  feasible.  NASA  is  conducting 
several  research  and  development  programs  specifically 
aimed  at  generation  of  the  critical  technology  for  such 
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advanced  control  aircraft  and  for  the  associated  digital 
flight  control  systems..  This  paper  provides  an  overview 
of  these  programs. 

Other  ongoing  NASA  efforts,  such  as  the  development 
of  highly-reliable,  easily-maintainable  computer  systems 
or  autoinatic  landing  systems  - essential  but  not  unique 
to  active  controls  - are  not  treated  here.  NASA- sponsored 
aircraft  design  studies  concerned  primarily  with  the 
definition  of  advanced  control  technology  requirements 
and  benefits  for  future  transports  - but  not  including 
control  research  and  development  efforts  - are  also 
omitted . 

TECHNOLOGY  OVERVIEW 

NASA  advanced  control  programs  can  be  naturally 
broken  into  the  development  of  improved  control  systems 
and  into  the  application  of  the  resultant  control  concepts 
for  the  design  of  more  efficient  transport  aircraft. 

Figure  1 introduces  the  related  activities.  Work  on 
advanced  control  systems  is  addressed  by  programs  on 
full  flight  envelope  autopilots  (FFEAP) , digital  fly-by- 
wire  systems,  innovative  avionics  systems,  and  propulsion 
control  systems.  The  extension  of  these  control  capabil- 
ities to  the  definition  and  validation  of  advanced  aircraft 
designs  will  be  addressed  by  the  active  control  aircraft 
and  the  proposed  active-control-configured  transport 
programs . 


Major  design  and  flight  test  milestones,  indicated 
on  the  figure,  for  the  NASA  programs,  will  be  outlined 
in  the  specific  summary  of  each  program.  Completion  of 
these  design  and  verification  tasks  by  the  early  1980 's  is 
planned  to  permit  the  incorporation  of  advanced  control 
concepts  in  the  next  generation  of  transport  aircraft  - 
currently  projected  to  enter  service  in  the  mid  to  late 
1980 's. 

Full-Flight-Envelope  Autopilots 
Under  the  first  program  on  improved  controls, 
the  Ames  Research  Center  is  investigating  the  application 
of  optimal  control  theory  to  the  design  of  full  flight 
envelope  autopilots  (reference  1) • The  associated  design 
approach  is  illustrated  in  figure  2.  The  aircraft  is 
calibrated  over  the  entire  flight  regime  by  trim  maps 
which  tabulate  lift,  drag,  and  moment  coefficients  versus 
critical  aircraft  variables  such  as  angle  of  attack  and 
flap  angle.  The  control  deflections  required  to  obtain 
a commanded  acceleration  can  then  be  calculated  from 
these  trim  maps,  with  feedback  used  to  compensate  for 
mismatch  between  the  trim  maps  and  the  actual  aircraft 
characteristics.  The  result  is  a linear  acceleration 
command  system,  and  linear  optimization  theory  can  be 
applied  to  define  desirable  overall  trajectory  and  attitude 
control  algorithms. 
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Detailed  design  of  this  full-fiight-envelope  auto- 
pilot (FPEAP)  is  presently  underway  and  is  expected  to 
be  completed  in  mid  1975.  Following  FFEAP  validation 
during  six-degree-of-freedom  simulations  in  1976,  the 
first  implementation  of  the  FFEAP  is  planned  as  an 
experiment,  the  FPEAP  algorithms  will  be  programmed 
on  the  onboard  STOLAND  system,  and  evaluated  during 
representative  flight  operations.  If  proven  successful, 
follow-on  flight  tests  of  the  FFEAP  system  will  be 
conducted  on  short-haul  powered-lift  aircraft,  such  as 
a tilt- rotor  configuration,  in  late  1978. 

Preliminary  FFEAP  results  indicate  that  the 
optimized  controller  mechanization  could  significantly 
increase  transport  aircraft  performance  over  the  entire 
flight  envelope,  and  could  minimize  delays  and  fuel 
consumption  during  terminal  area  operations. 

Digital  Fly-By-Wire  Systems 
A companion  NASA  control  system  program,  conducted 
jointly  by  the  Flight  Research  Center  and  the  Langley 
Research  Center,  involves  the  development  and  flight 
verification  of  digital  fly-by-wire  (DFBW)  systems. 

The  basic  phases  of  this  program  are  represented  in 
figure  3.  Phase  I (references  2-4)  has  demonstrated 
the  feasibility  and  performance  of  DFBW  control  using 
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Apollo  hardware  in  a single-channel  primary  system  with 
a triplex  analog  backup  system  (reference  5)  installed  in 
an  F-8  aircraft.  Direct,  stability  augmentation,  and 
command  augmentation  system  modes  were  successfully 
evaluated  during  approximately  18  months  of  flight  testing. 
For  Phase  II,  the  Phase  I fly-by-wire  systems  will  be 
replaced  by  a triplex  all  DFBW  systeni  using  aircraft- 
compatible  computers  and  sensors.  The  all-DFBW  system 
will  then  serve  as  a test  bed  for  early  verification 
of  critical  Space  Shuttle  software  concepts  and  for 
flight  implementation  of  several  advanced  control  law 
concepts.  The  first  of  these,  summarized  in  figure  4, 
will  investigate  performance  improvements  obtainable 
through  synthesis  of  selected  control  configured 
vehicle  (CCV)  concepts.  Specific  CCV  systems  considered 
include  static  stability  augmentation,  maneuver  and  gust 
load  control,  and  envelope  limiting.  The  associated 
control  algorithms  were  designed  through  an  iterative 
quadratic  optimization  process  (reference  6) , and  are 
being  validated  during  laboratory  simulations  at  the 
Langley  Research  Center.  After  software  coding  and 
iron-bird  checkout  of  the  CCV  algorithms,  first  flight 
tests  of  the  CCV  system  are  scheduled  for  mid  1976. 

The  second  advanced  control  study,  illustrated  in 
figure  5,  addresses  the  mechanization  of  an  adaptive 
control  system  compatible  with  potential  transport 

7 


applications.  Candidate  concepts  under  investigation 
are  an  implicit  identification  scheme  (reference  7) 
involving  multiple-model  hypothesis  testing;  and  two 
explicit  identification  schemes  based  on  different 
techniques  for  parameter  identification  and  control 
optimization.  The  first  uses  a recursive,  weighted- 
least-squares  identifier,  and  an  algebraic  equation  to 
determine  the  control  changes  from  the  previous  commands 
(reference  8) . The  second  uses  a modified  Newton- 
Raphson  technique  for  identification.  Other  potential 
advanced  control  approaches  being  considered  for  flight 
test  include  self-organizing  systems  (references  9-10) , 
which  can  automatically  restructure  themselves  to 
accommodate  sensor  and  actuator  failures  with  considerable 
attendant  reliability  increases;  and  learning  control 
systems  with  the  capability  to  evolve  improved  aircraft 
modeling  and  estimation  techniques  during  flight.  The 
most  promising  of  these  control  concepts  will  be  selected 
for  flight  implementation  in  1976.  In-flight  tests  on 
the  F-8  will  then  be  conducted  in  1977,  following  mechan- 
ization and  ground  verification  of  the  resultant  flight 
control  systems. 

Current  Flight  Research  Center  plans  for  the  total 

redundant  DFBW  systems  tests  call  for  a 30  month  flight 

test  program  beginning  in  1976.  Approximately  six 
months  will  be  devoted  to  validation  of  the  basic  system. 


configuration  and  to  inflight  verification  of  Space 
Shuttle  software  designs.  The  remainder  of  the  program 
will  be  available  for  the  advanced  control  law  tests. 

Innovative  Avionics  Systems 

Besides  these  efforts  on  the  exploitation  of  digital 
control,  work  at  the  Flight  and  Ames  Research  Center  is 
concerned  with  the  design  and  mechanization  of  innovative 
avionics  systems  which  could  reduce  avionics  cost 
through  simplification  and  modularization.  While  the 
primary  users  of  such  concepts  will  be  general  aviation 
aircraft,  many  of  the  associated  design  philosophies 
may  be  applicable  to  transports  as  well. 

One  of  these  concepts,  depicted  in  figure  6, 
involves  the  development  and  flight  demonstration  of  a 
separate  surface  stability  augmentation  system  (SSSAS) 
on  a Beech  99  commuter  airlines  under  a contract  managed 
by  the  Flight  Research  Center.  With  this  approach 
(reference  11) , the  aircraft  control  surfaces  are  split 
into  primary  and  secondary  segments,  and  the  separate 
secondary  surfaces  are  incorporated  in  a limited- 
authority  ride  smoothing  and  gust  alleviation  system. 
Since  the  primary  control  system  can  overide  the 
secondary  system  in  case  of  a hard-over  failure,  the 
SSSAS  may  be  mechanized  with  single-string,  low-cost 
components  with  considerable  associated  system  cost 
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savings.  Major  improvements  in  ride  quality  are  expected 
through  this  approach,  which  will  be  validated  during 
extensive  flight  tests  in  1975. 

Another  low-cost  avionics  program,  conducted  by 
the  Ames  Research  Center,  focuses  on  the  design  of 
integrated  avionics  systenis  which  take  maximum  advantage 
of  recent  advances  in  microeleetronics  and  digital 
circuit  technology.  The  design  philosophy  for  this 
system,  illustrated  in  figure  7,  will  be  initiated  with 
subsystem  concept  studies  and  1980  technology  and  a-lr 
traffic  projections.  The  resultant  specifications  and 
requirements  will  be  used  to  define  candidate  modular 
avionics  systems.  The  most  cost-effective  of  these 
systems  will  be  carried  through  subsystem  development 
and  final  design  by  1979;  and  will  be  evaluated  through 
piloted  flight  simulations  in  1980. 

Propulsion  Control  Systems 

The  application  of  advanced  control  techniques  to 
the  optimization  of  aircraft  propulsion  systems  perform- 
ance can  also  result  in  large  improvement  in  engine 
thrust  and  fuel  economy.  Two  related  NASA  programs, 
conducted  jointly  by  the  Flight  and  Lewis  Research 
Centers,  are  concerned  with  the  development  of  integrated 
propulsion  control  systems  (IPCS)  and  with  cooperative 
aircraft  and  propulsion  control. 
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For  the  first  of  these  efforts,  the  Air  Force  and 
NASA  have  undertaken  a joint  program  (reference  12)  to 
demonstrate  inflight  the  benefits  obtainable  from  an 
integrated  propulsion  control  system  in  an  F-111 
aircraft.  The  associated  design  philosophy,  indicated 
in  figure  8,  utilizes  a high”response  control  system 
which  rapidly  senses  changes  in  flow  conditions 

and  uses  a digital  controller  to  command  engine 
inlet  geometry  configurations  needed  for  optimal 
propulsion  performance.  Such  an  IPCS  can  minimize 
stall  margin  throughout  the  flight  environment,  and 
could  permit  significant  reduction  in  current  engine 
safety  margins,  with  attendant  increases  in  range 
projected  as  large  as  10  percent.  The  F-111  IPCS  is 
slated  for  flight  tests  in  1975. 

A second  NASA  effort  on  propulsion^control  involves 
the  integration  of  the  propulsion  and  aircraft  control 
systems  (reference  13)  for  the  YF-12  research  vehicle. 
The  analysis  of  supersonic  flight  tests  on  the  XB-70 
and  YF-12  indicate  that  airframe/propulsion  system 
interactions  are  the  primary  cause  of  altitude  fluctua- 
tions in  supersonic  cruise,  of  poor  lateral-directional 
characteristics,  and  of  severe  transients  during  inlet 
unstarts.  It  is  clear  from  these  flight  results  that 
the  propulsion  system  cannot  be  treated  independently 
from  the  aircraft  control  system.  A proposed  integrated 
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airframe/propulsion  control  system,  shown  in  figure  9,  thus 
incorporates  a digital  control  system  which  combines  the 
inlet,  engine  and  airplane  flight  controls.  The  longitu- 
dinal phase  of  this  cooperative  control  system  will  be 
flight  tested  on  a YF-12  in  1975,  followed  by  YF-12 
flight  tests  of  the  lateral  directional  phase  in  1976. 
Design  specifications  for  a total  cooperative  control 
system,  based  on  these  interim  test  results,  are  expected 
to  be  available  by  late  1977. 

The  most  significant  payoff  of  the  advanced  control 
approaches  discussed  so  far  requires  consideration  of 
their  capabilities  in  the  selection  of  the  initial 
aircraft  configuration  through  a new  aircraft  design 
approach  which  permits  full  tradeoffs  between  aerody- 
namics, structures,  and  control  for  the  designated 
mission  requirements.  With  this  active  control 
design  approach,  reductions  in  the  aircraft  natural 
aerodynamic  Stability  and  structural  loads  could  be 
obtained  through  reliance  on  the  damping  and  load 
control  capabilities  of  a flight-critical  automatic 
control  system.  These  reductions  in  turn  can  permit  large 
savings  in  aircraft  gross  weight  and  fuel.  NASA  is 
conducting  two  programs  to  provide  and  verify  the 
critical  technology  required  for  early  application 
of  such  active  control  designs  in  future  civil  transports. 
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Active  Control  Aircraft 
The  Active  Control  Aircraft  (ACA)  program, 
carried  out  by  the  Langley,  Flight  and  Ames  Research 
Centers,  concentrates  on  development  of  the  integrated 
active  control  systeni  and  aircraft  design  technology 
to  meet  the  needs  of  new  short-haul  and  long-haul 
transport  designs  in  the  early  1980  Vs.  Initial  work 
will  focus  on  the  formulation  of  an  adequate  modeling 
and  analysis  base  for  ACA  design.  Specific  associated 

I; 

tasks  include  the  generation  and  validation  of  transonic 
aerodynamic  pressure  distributions  for  deflected  and 
oscillating  control  surfaces,  of  aeroelastic  design 
programs  for  flutter  suppression,  of  prediction  tech- 
niques for  aircraft  structural  dynamics  and  static 
deformations,  and  of  insensitive  control  techniques 
which  allow  for  uncertainties  in  the  aircraft  aerodynamic 
and  structural  parameters.  An  integrated  conceptual 
design  program  incorporating  these  modeling  and  analytical 
procedures  for  ACA  will  be  derived  to  permit  incorporation 

f 

of  all  the  active  control  functions  into  a workable 
system,  and  selection  of  the  most  cost-effective  aircraft 
configuration  for  a given  mission.  One  of  the  approaches 
under  consideration  for  the  conceptual  design  process  is 
outlined  in  figure  10.  After  specification  of  general 
configuration  guidelines  and  mission  requirements,  this 
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computer-aided  design  program  defines  the  initial 
aircraft  geometry  and  uses  a quadratic  optimization 
procedure  to  converge  on  suitable  final  configurations. 

An  economic  assessment  subroutine  is  then  employed  to 
determine  the  best  of  these  alternate  configurations, 
and  to  select  the  final  active  control  aircraft  and 
system  designs.  To  provide  the  necessary  system  and 
aircraft  inputs  for  this  approach,  wind  tunnel  tests 
and  validation  flights,  using  DHC-6  and  subsonic 
transport  "te^t  beds",  are  planned  in  1976  and  1977. 

The  next  phase  of  the  program  involves  the 
extension  of  this  initial  work  into  specific  short-haul 
and  long-haul  transport  applications.  For  the  short- 
haul  application,  depicted  in  figure  11,  a ride  quality 
and  precise  trajectory  tracking  system  will  be  designed 
and  installed  on  a DHC-6  Twin  Otter  aircraft.  Representa- 
tive operational  flights  of  the  modified  DHC-6  will  be 
conducted  in  1978  to  demonstrate  the  active  control 
system  performance  and  benefits.  The  system  is 
expected  to  significantly  improve  ride  quality  for 
low-wing-loading  STOL  aircraft,  as  indicated  in  the 
figure.  Following  completion  of  these  tests,  a more 
extensive  short-haul  active  control  design  for  powered- 
lift  aircraft  incorporating  envelope  limiting,  ride 

quality  control,  gust  load  alleviation,  maneuver  load 
control,  and  flight  path  control  will  be  designed  and 


evaluated  for  a Tilt  Rotor  vehicle.  Completioh  of  these 
evaluations  is  scheduled  for  the  mid  1979  time  frame. 

For  the  long-haul  application,  represented  in 
figure  12,  a series  of  contracted  active  control  aircraft 
designs  considering  reduced  static  stability,  gust  and 
maneuver  load  alleviation,  ride  quality  and  fatigue-life 
control,  envelope  limiting,  and  flutter  and  structural 
mode  suppression  will  be  conducted  for  representative 
subsonic,  freighter,  transonic,  and  supersonic  missions; 
and  the  results  will  be  compared  with  conventional  aircraft 
designs.  The  most  promising  of  these  designs  will  then 
be  evaluated  in  the  1980-1981  time  period  through  design, 
fabrication  and  flight  tests  of  a scaled  research 
vehicle  which  will  concentrate  on  the  demonstration  of 
the  high-risk  technologies  essential  to  validation  of 
the  ACA  design  techniques. 

Completion  of  the  ACA  program  should  provide  a 
comprehensive  design  base  for  the  application  of 
active  control. 

Active  Control  Configured  Transport 

In  addition  to  NASA ' s work  on  active  control 
design  procedures  and  systems,  a companion  program  which 
would  carry  this  technology  into  practice  through  actual 
redesign  of  a jet  transport  is  under  consideration  for 
initiation  in  mid  1975.  This  Active  Control  Configured 
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Transport  (ACCT)  program,  to  be  managed  by  the  Flight 
Research  Center,  would  make  direct  use  of  the  digital-fly- 
by wire  and  active  control  technology  program  outputs  to 
redesign  a small  jet  transport,  such  as  a Jetstar  or 
B-737,  to  evaluate  the  resultant  benefits  and  penalties 
in  a realistic  operational  environment.  Such  a recon- 
figured aircraft  could  offer  major  performance  improve- 
ments (reference  14)  through  synergism  of  active  controls 
and  advanced  aerodynamic  technologies.  Figure  13 
illustrates  some  of  these  potential  benefits  in  terms 
of  relative  fuel  consumption.  While  individual 
contributions  of  either  control  or  aerodynamic  technologies 
are  relatively  small,  the  combination  of  a fly-by-wire 
active  control  system  with  a high-aspect-ratio  super- 
critical wing  design  made  possible  through  maneuver- 
load  and  gust  alleviation  can  yield  appreciable  fuel 
savings.  Noise  footprints  for  such  an  ACCT  design 
could  also  be  reduced  by  as  much  as  90%,  based  on  early 
engineering  estimates . 

The  ACCT  program,  represented  in  figure  14,  could 
include  an  actively-controlled  supercritical  wing 
located  for  optimum  static  margin  and  a corresponding 
new  horizontal  and  vertical  tail.  To  minimize 
demonstration  costs,  the  associated  active  control 
system  could  be  mechanized  using  the  all  DFBW  system 
proven  during  the  F-8  program.  Extensive  ACCT  flight 
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tests  would  verify  the  fuel  savings  and  performance  and 
ride  quality  improvements  obtainable  with  an  integrated 
active  control  transport  design,  and  would  provide 
invaluable  experience  on  the  active  control  systeni  and 
aircraft  operations  in  a representative  flight  environ- 
ment. 

If  warranted  by  the  initial  conceptual  designs  and 
cost/benefit  studies,  an  ACCT  test  aircraft  would  be 
selected  in  1976.  Design  of  an  active  control  configur- 
ation for  this  transport  could  be  completed  in  1977,  and 
the  test  aircraft  could  be  modified  by  1979  for  opera- 
tional flights  in  the  1980-1981  time  span.  By  involving 
potential  users  throughout  the  design,  implementation, 
and  flight  test  phases  of  such  a demonstrator,  airline, 
industry,  and  FAA  acceptance  of  active  controls  could 
be  significantly  accelerated  and  the  associated 
technology  could  be  made  widely  available  for  future 
transport  applications . 

CONCLUDING  REMARKS 

The  successful  completion  of  the  NASA  programs 
touched  on  in  this  brief  overview  should  permit  a major 
step  forward  in  the  application  of  advanced  control 
concepts  by  providing  a better  understanding  of  the 
associated  system  and  aircraft  design  problems  and 
benefits.  Maximxam  participation  by  industry  in  the 


definition  and  implementation  of  these  programs,  and  wide 
dissemination  of  the  resultant  design,  development,  and 
flight  test  data  will  - we  hope  - be  instrxamental  in 
bringing  about  the  early  realization  of  the  potential  of 
active  controls. 

We  Stand  on  the  threshold  of  a revolution  in  air- 
craft design,  if  we  can  learn  to  practically  harness 
the  capability  of  digital  avionics  and  advanced 
controls.  With  the  increased  emphasis  on  cost- 
effectiveness  and  fuel-economy,  we  must  take  full 
advantage  of  this  capability  for  the  development  of 
more  efficient  and  competitive  future  transports  to 
maintain  our  leadership  role  in  the  marketplace  - 
and  in  the  air. 


18 


REFERENCES 


1.  Meyer,  G. : Methodology  for  Design  of  Active  Controls 

for  V/STOL  Aircraft.  NASA  Symposium  on  Advanced  Control 
Technology  and  Its  Potential  for  Future  Transport  Aircraft, 
1974. 

2.  Beets,  D.  A.;  and  Szalai,  K.  J. : Design  and  Flight 

Experience  with  a Digital  Fly~By-Wire  Control  System  Using 
Apollo  Guidance  Systems  Hardware  on  an  F-8  Aircraft.  AIAA 
Paper  No.  72-881,  1972. 

3.  Deets,  D.  A.:  Design  and  Development  Experience  with 

a Digital  Fly-By-Wire  System  Control  System  in  an  F-8 
Airplane.  NASA  Symposium  on  Advanced  Control  Technology 
and  Its  Potential  for  Future  Transport  Aircraft,  1974. 

4.  Szalai,  K.  J. ; Flight  Test  Experience  with  the  F-8 
Digital  Fly-By-Wire  System,  a Forecast  for  ACT.  NASA 
Symposivim  on  Advanced  Control  Technology  and  Its  Potential 
for  Future  Transport  Aircraft,  1974. 

5.  Lock,  W. ; Peterson,  W. ; and  Whitman,  G. : Mechanization 

and  Experience  with  a Triplex  Fly-By-Wire  Backup  Control 
System.  NASA  Symposium  on  Advanced  Control  Technology  and 
Its  Potential  for  Future  Transport  Aircraft,  1974. 


19 


6.  'Van  Dierendonck,  A.  J. ; Practical  Optiinal  Flight 
Control  for  Aircraft  with  Large  Flight  Envelopes. 

AIAA  Paper  73-159,  1973. 

7.  Athens,  M. ; and  Willner,  W. : A Practical  Scheme 

for  Adaptive  Aircraft  Flight  Control  Systems.  NASA 
Symposium  on  Parameter  Estimation,  1973. 

8 . Kaufman , H . ; and  Berry , P . : Digital  Adaptive 

Flight  Controller  Development.  Twelfth  Symposium  on 
Adaptive  Processes,  1973. 

9.  Montgomery,  R.  C.;  and  Caglayan,  A.  K. ; A Self- 
Reorganizing  Digital  Plight  Control  System  for 
Aircraft.  AIAA  l2th  Aerospace  Sciences  Meeting,  1974. 

10.  Montgomery,  R.  C.;  and  Price,  D.  B. : Management 

of  Analytical  Redundancy  in  Digital  Plight  Control 
Systems  for  Aircraft.  AIAA  Mechanics  and  Control 

of  Flight  Conference,  1974. 

11.  Roskam,  j. ; Barber,  M.  R. ; and  Loschke,  P.  C.: 
Separate  Surfaces  for  Automatic  Flight  Controls.  SAE 
Paper  730  304,  1973. 


20 


12.  Benz,  G.  E.;  and  Zeller,  John  R. : Integrated 

Propulsion  Control  System  Program.  SAE  Paper  730359, 
1973 . 

13.  Berry,  G.  T.;  and  Gilyard,  Glenn  B. : Some 

Stability  and  Control  Aspects  of  Airplane/Propulsion 
System  Interactions  on  the  YF-12 . ASME  Winter  Annual 
Meeting,  1973. 

14.  Lange,  R.  H.;  and  Deets,  D.  A.;  A Study  of  an 
ACT  Demonstrator  With  Substantial  Performance 
Improvements  Using  a Redesigned  Jet  Star.  NASA 
Symposium  on  Advanced  Control  and  Its  Potential  for 
Future  Transport  Aircraft,  1974. 


22 


V.'  /v/.V'V-:  - 


»ifeiiliiliiii«^«M 


illl®ilili»lM 


9SS9^8tSI^MB 

ii|iiil^|ISiiSp|liS|^^ 

^^■iiiilliiliS 


IliliiiiM 

' ^ •;?.  ''/.  • ‘ ,'V  ‘. 

iiiliiiiiiiiiitiiiiiii^ 


REPRODUGBILITY  OF  THE 
ORMMM.  PASS  IS  POOR 


EEPBODUGiBMTY  OF  THE 
ORMII4  FASE  IS  POOR 


DIGITAL  FLY-BY-WIRE  FLIGHT  TESTS 

ADAPTIVE  CONTROL  CONCEPTS 


COMPUTATION 


27 


INTEGRATED  AVIONICS  SYSTEM 


28 


INTEGRATED  PROPULSION  CONTROL  SYSTEM 


29 


ENGINE  STALL  MARGIN  ENGINE  STALL  MARGIN 


COOP  AUTOPILOT/SAS/PROPULSION  CONTROL  SYSTEM 


30 


SERVOS 


ACTIVE  CONTROL  AIRCRAFT 

SYSTEM  DESIGN  & VALIDATION 


- N0I1VH31H33V  %m  1V3illi3A 


32 


DHC-6  TWIN  OTTER  AIRCRAFT 


ACTIVE  CONTROL  AIRCRAFT 
HIGH-RISK  CONCEPT  VERIFICATION 


ACTIVE  CONTROL  CONFIGUREO  TRANSPORT 

POTENTIAL  BENEFITS  ACCT  REDES 


I—  >- 

o >. 

IK  _j 


34 


RELATIVE  REDUCTION  IN  FUEL  CONSUMPTION 


ACTIVE  CONTROL  CONFIGUREO  TRANSPORT 

PROGRAM  OBJECTIVES 


35 


• CONFIDENCE 

• EXPERTISE 


AFFDL  ADVANCED  CONTROL  TECHNOLOGY  PROGRAMS  - 

AN  OVERVIEW 


William  E . Lamar 

Air  Force  Flight  Dynamics  Laboratory 


ABSTRACT 


Over  the  past  years  the  Air  Force  Flight  Dynamics  Laboratory  has  been  active 
in  developing  a broad  technology  base  for  advanced  flight  control  systems , This 
has  permitted  timely  implementation  and  continued  progressive  evaluation  of 
Control  Configured  Vehicle  (CCV)  concepts.  The  recent  fly-by-wire  and  CCV  B-52 
successes  have  led  to  increased  application  of  the  concept  in  such  aircraft  as  the 
B-1,  C-5A,  YF-16,  and  YF-17.  The  new  Advanced  Fighter  Technology  Integra- 
tion (AFTI)  program  of  the  Laboratory  represents  a more  extensive  embodiment  of 
the  concept  of  a control  configured  aircraft . 
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SURVIVABLE  FLIGHT  CONTROL  SYSTEM 
FLY-BY-WIRE  DEVELOPMENT  AND  FLIGHT  TEST 


James  E . Hunter 

Air  Force  Flight  Dynamics  Laboratory 
SUMMARY 


The  United  States  Air  Foree  initiated  the  Survivahle  Flight  Control 
System  (SFCS)  Advanced  Development  Program  in  July  1969  in  which  one  of 
the  major  objectives  was  to  establish  the  practicality  of  the  Fly-by- 
Wire  (FEW)  concept  for  use  in  military  fighter  aircraft.  This  advanced 
development  program  provided  for  the  design,  fabrication,  qualification, 
and  highly  successful  flight  test  evaluation  of  a quad-redundant  FEW 
primary  flight  control  system  in  an  F-4  aircraft  without  conventional 
mechanical  controls. 

Results  from  this  intensive  FEW  advanced  development  effort 
indicate  significant  improvements  in  overall  flight  control  system 
performance,  reliability,  safety  and  maintainability.  Additionally, 
the  strong  and  credible  FEW  technology  base  developed  as  a result  of 
this  program  has  paved  the  way  for  further  exploitation  through  the 
application  of  advanced  concepts  such  as  Control  Configured  Vehicles 
and  Multi-Mode  Controls. 


INTRODUCTION 


The  Air  Force  has  accomplished  a significant  major  milestone  in 
advanced  fighter  flight  control  design  and  reliability  with  successful 
completion  of  its  fly-by— wire  flight  test  under  the  Survivahle  Flight 
Control  System  CSFCS)  Program.  This  portion  of  the  SFCS  Program  has 
consisted  of  a four  year,  $16.5  million  development  program  with  primary 
objective  for  developing  and  flight  testing  control  elements  to  improve 
combat  survivability  of  aircraft  weapon  systems.  The  development  program 
was  performed  by  McDonnell  Douglas  under  contract  to  the  Air  Force  Flight 
Dynamics  Laboratory,  with  Sperry  Rand,  General  Electric,  and  Lear  Slegler 
as  the  principal  equipment  suppliers.  Although  the  primary  purpose  of  this 
program  was  to  develop  a highly  reliable  flight  control  system  designed 
to  improve  survivability,  major  improvements  in  handling  qualities,  sta- 
bility and  performance,  and  weapon  delivery  accuracy  were  also  achieved 
goals . 

The  SFCS  mechanized  in  a YF-4E  test  aircraft  uses  a quadruply  redundant 
(two-fail  operate),  dispersed,  three-axis,  analog,  fly-by-wlre  (FEW)  primary 
flight  control  system  allowing  the  pilot  to  command  aircraft  motion  rather 
than  the  conventional  control  surface  position.  This  is  the  first  high 
performance  fighter  aircraft  ever  to  fly  using  a futuristic  "all  electric" 
system. 

The  potential  and  advantages  of  FEW  had  been  demonstrated  in  several 
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exploratory  development  programs  beginning  in  1959  at  the  Flight  Dynamics 
Laboratory.  FEW  acceptance  was  dependent  upon  answering  the  question  of 
whether  electrical  control  systems,  such  as  implemented  in  the  SFCS,  could 
be  made  as  reliable  as  conventional  mechanical  control  systems.  The  task, 
undertaken  during  the  SFCS  flight  test,  was  to  demonstrate  that  the  system 
developed  during  this  program  performs  significantly  better  with  greater 
reliability  than  currently  operational  flight  control  systems. 


TECHNICAL  APPROACH 


Simple  direct  mechanical  linkages,  cables,  and  feel  springs  for  manual 
control  can  no  longer  cope  with  meny  of  the  control  system  problems  associ- 
ated with  modem  high  performance  aircraft  and  aerospace  vehicles.  In  an 
effort  to  meet  the  greater  demands  of  these  advanced  control  system  require- 
ments, the  flight  control  designer  has  been  forced  to  increase  the  complexity 
of  the  mechanical  system  with  a resulting  increase  in  weight,  volume,  cost, 
and  a decrease  in  flexibility  and  reliability.  Often  he  is  forced  to  com- 
promise between  the  desired  performance  and  design  requirements  and  a prac- 
tical mechanization.  FEW  not  only  meets  tjie  demands  of  these  advanced  control 
system  design  requirements  but  does  so  with  a decrease  in  complexity,  weight, 
volume  and  cost.  It  also  provides  an  increase  in  flexibility,  reliability, 
and  by  utilizing  redundancy  and  dispersion  increased  survivability. 

While  providing  improved  survivability,  it  was  felt  and  later  verified 
that  the  use  of  FEW  primary  flight  control  would  enable  major  improvements  in 
the  tactical  capability  of  the  vehicle.  The  design  of  the  system  was  there- 
fore based  upon  studies  to  define  a set  of  control  laws  which  provided  nearly 
optimum  aircraft  response  characteristics  desired  by  pilots  for  use  during 
the  various  mission  tasks  assigned  to  the  test  aircraft  in  its  normal  opera- 
tional use. 

Traditional  performance  criteria,  such  as  many  of  those  presented  in 
MIL-F-8785E,  were  directed  toward  bounding  the  values  of  various  short  period 
response  parameters  such  as  frequency,  damping,  time  constants,  etc. , which 
pilots  have  felt  are  consistent  with  the  precision  and  control  needed  during 
maneuvering  flight.  Many  of  these  parameters  which  are  easily  defined  in 
terms  of  the  basic  aircraft  dynamics  are  often  masked  by  the  forced  response 
of  multiloop  high  gain  control  systems.  The  newer  control  performance  cri- 
teria express  short  period  response  in  terms  of  a response  envelope  in  the 
time  domain.  These  criteria  are  applicable  to  both  the  high  gain  multiloop 
controlled  aircraft  response  and  the  basic  aircraft  response,  and  are  a 
supplement  to  the  traditional  forms  of  control  performance  criteria. 

The  new  criteria  used  in  the  SFCS  program  consist  of  three  basic  time 
history  performance  criteria  with  boundaries  on  both  the  basic  parameter 
and  the  time  rate  of  change  of  that  parameter.  These  parameters  are  a 
normalized  blend  of  pitch  rate  and  normal  acceleration  (C*)  for  the  pitch 
axis,  a normalized  roll  rate  for  the  roll  axis,  and  a normalized  blend 

of  lateral  acceleration  and  sideslip  (D*)  for  the  directional  axis.  A C* 
criterion  has  been  available  for  some  time  as  documented  in  Reference  5. 

The  definition  of  the  C*  expression  in  equation  form  as  used  in  the  SFCS 
program  is: 
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C*  = Anzp  + K2q 


Anzp  = Incremental  normal  load  factor  at  pilot  station  Cg*s) 
q = Pitch  rate  C^ad/sec) 

K2  = ^2Vcq  = Pitch  rate  gain  constant 

t 9 

C2  = Dimensional  constant  (1/32.2  ) 

Yqq  “ Crossover  velocity  (assume  400  ft/sec) 

The  Ang  is  the  total  incremental  load  factor  at  the  pilot  station  and 
includes  normal  effective  acceleration  at  the  aircraft  center  of  gravity  (c.g.) 
and  the  additional  normal  acceleration  at  the  pilot  station  due  to  pitch  ac-- 
celeration  (q)  , multiplied  by  the  moment  arm  from  the  vehicle  c.g.  to  the 
pilot  station.  The  studies  reported  in  Reference  2 proposed  modifications  to 
the  C*  boundary  presented  in  Reference  5.  Figure  1 shows  the  proposed 
normalized  C*  envelope  and  a C*,  or  normalized  r^te  of  change  of  C*,  envelope. 
The  C*  envelope  is  required  to  control  higher  order  effects  such  as  low  damped 
low  amplitude  oscillations  which  could  be  accommodated  by  the  C*  envelope  but 
still  be  tindesirable. 

The  Pjj  response  envelope  is  shown  in  Figure  2.  Included  also  is  a roll 
acceleration  (P^)  response  envelope.  These  envelopes  restrict  the  roll  mode 
response  time  constant,  overshoot  and  oscillations. 

The  criteria  define  the  transient  response  characteristics  in  the 
directional  axis  due  to  a lateral  step  command  input  from  the  pilot.  The  D* 
expression  combines  sideslip,  which  is  considered  the  principal  low  speed 
handling  quality  parameter,  and  lateral  acceleration,  which  is  a more  im- 
portant consideration  during  high  speed  flight.  The  definition  of  the  D* 
expression  in  equation  form  as  used  in  the  SFCS  program  is: 

D*  = Allyp  + K33 

dJ  = D*/K3  = 3 + Anyp/K3 

Anyp  = Incremental  lateral  load  factor  at  pilot  station  (g’s) 

3 = Sideslip  angle  (rad) 

K3  = C3q^^  = Slideslip  gain  constant 

Co  = Dimensional  constant  (-9.91  x 10“^  C, 

lb 

q^,Q  = Crossover  Ifynamic  Pressure  (assume  350  Ib/ft^) 

The  AUyp  is  the  total  incremental  lateral  acceleration  at  the  pilot 
station.  It  includes  lateral  acceleration  at  the  aircraft  c.g.  and  the 
additional  lateral  acceleration  at  the  pilot  station  due  to  roll  acceleration 
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(p)  and  yaw  acceleration  (r)  multiplied  by  the  respective  moment  arms. 

The  roll  moment  arm  is  the  distance  from  the  roll  axis  to  the  pilot  station. 
The  yaw  moment  arm  is  the  distance  from  the  aircraft  c.g.  to  the  pilot 
station. 

In  contrast  to  the  C concept  where  the  equivalent  gain  constant  is  a 
function  of  velocity,  the  D*  equation  employs  a crossover  dynamic  pressure 
to  establish  when  low  and  high  speed  flying  qualities  are  rated  equally. 

The  D*  equation  can  be  modified  to  yield  an  expression  which  is  more  in 
harmony  with  the  traditional  lateral-directional  handling  qualities  speci- 
fications on  sideslip  excursion  limitations.  This  expression,  D*,  has 
the  sideslip  units  of  degrees  or  radians . Figure  3 shows  the  D*  and  D*, 
the  rate  of  change  of  Di,  boundaries  used  in  the  SFCS  program.  The  boundaries 
are  expressed  in  terms  of  the  factor  "K”,  where  "K"  is  the  ratio  of  ’’commanded 
roll  performance”  to  ’’applicable  roll  performance  requirement”  as  defined  in 
MIL-F-8785B. 

Having  now  established  the  performance  criterion  a six-degree-of-freedom, 

man- in- the- loop  simulation  program  was  conducted  to  evaluate  the  control 
law  implementation.  This  simulation  included  the  capability  to  maneuver  the 
aircraft  throughout  the  F-4  flight  envelope  including  stall  and  post  stall 
conditions.  As  a result  of  this  simulation,  several  design  modifications 
were  identified,  evaluated,  and  subsequently  implemented  into  the  SFCS  de- 
sign. A series  of  simulations  were  used  during  the  development  and  test  of 
the  SFCS  to  assist  not  only  in  the  design,  but  to  verify  equipment  per- 
formance, train  pilots,  and  correlate  flight  test  data.  This  test  program 
has  shown  the  importance  of  compatibility  testing  with  a manned  simulator 
in  preparing  for  a flight  test  program.  Reference  1 describes  completely 
the  thorough  simulation  effort  which  resulted  in  savings  of  time,  money, 
and  most  importantly  accelerated  progression  to  three-axis  FBW  control  of 
the  aircraft  in  the  very  early  stages  of  the  flight  test  program. 


SYSTEM  DESCRIPTION 


The  SFCS  is  a three-axis,  analog,  fly-by-wire,  primary  flight  control 
system  using  secondary  actuators  to  provide  position  commands  to  the  surface 
actuators. 

The  system  functions  in  a closed  loop  as  a direct  function  of  pilot 
applied  inputs  to  command  aircraft  motion,  instead  of  surface  position.  In 
addition  to  conventional  controls,  a sldestlck  controller  (SSC)  located  on 
the  pilot’s  right-hand  console  is  included  for  SFCS  control.  The  final  con- 
figuration of  the  SFCS  as  mechanized  had  no  mechanical  control  of  control 
surface  position  in  any  of  the  three  axes.  In  addition  to  a normal  mode  of 
operation  which  commands  aircraft  motion,  electrical  backup  modes  command 
surface  positions  in  the  event  of  malfunctions  of  the  normal  mode.  A capa- 
bility for  reversion  to  a mechanical  backup  mode,  provided  in  the  pitqh  and 
yaw  axes  for  the  early  phase  of  the  flight  testing,  was  removed  following 
flight  test  validation  of  the  SFCS  modes  and  functions. 

The  normal  mode  shown  in  Figure  4 utilizes  rate  and  acceleration  feed- 
backs to  control  aircraft  motion.  The  three  levels  of  closed-loop  gain  for 
the  pitch  and  yaw  normal  modes  may  be  selected  either  by  the  pilot  or  auto- 
matically by  the  adaptive  gain  computer.  This  variable  gain  system  provides 
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an  almost  unchanging  air- 
craft djmamic  response  for 
varying  flight  conditions. 

The  pitch  axis  normal  mode 
provides  a neutral  speed 
stability  (NSS)  auto-trim 
function  with  the  landing 
gear  retracted.  The  auto- 
trim is  provided  by  inte- 
gration implemented  in  the 
forward  loop.  A stall  warning 
function  is  provided  through 
a blend  of  angle-of-attack  and 
lagged  pitch  rate.  Nose  down 
pitch  rates  are  rejected  in 
the  control  law  so  that  pilot  push-recovery  from  a stall  condition  is  not  im- 
peded. The  stall  warning  function  is  to  reduce  the  command  gain  in  the 
longitudinal  axis,  effectively  increasing  stick  force  per  g,  and  to  remove  the 
roll  rate  feedback  from  the  roll  axis;  both  changes  occur  linearly  as  the  stall 
region  is  penetrated. 

Quarduplex  (four  channel)  redundancy  is  used  in  all  system  components  to 
provide  improved  system  reliability  and  to  achieve  a two-fail  operate  system. 
Four  transformer  rectifiers  (TR)  , each  shunted  by  a battery,  are  independent 
power  supplies.  Two  engine-driven  ac  generators  provide  the  primary  source 
of  power  to  the  four  TRs.  In  the  event  of  a single  generator  failure,  the 
remaining  unit  can  power  all  four  TRs.  If  both  generators  fall,  the  batteries 
can  power  the  SFCS  for  approximately  one  hour  of  flight  tiiae,  sufficient  to 
allow  for  a return  to  base.  Three  hydraulic  pressure  sources  are  normally 
available  in  the  F-4  aircraft;  PC-1,  PC-2  and  utility.  A fourth  hydraulic 
system,  required  to  maintain  quadruplex  redundancy  for  the  test  aircraft,  was 
an  auxiliary  power  unit  containing  an  electric  motor  driven  hydraulic  pump. 

The  necessary  computations  for  the  three  control  axes  are  performed  by 
four  analog  computer  voter  units  (CVU) , one  for  each  of  the  four  channels. 

The  quadruplex  electrical  signals  in  each  of  the  three  axes  are  processed  by 
signal  selection  devices,  and  the  selected  signals  are  applied  to  electro- 
hydraulic  secondary  actuators.  Four  secondary  actuators  provide  mechanical 
inputs  to  the  rudder,  stabilator  and  the  two  aileron  and  spoilor  surface 
actuators.  Each  secondary  actuator  (SA)  is  quadruplex  in  that  four  identical 
units  are  Integrated  side  by  side  and  their  output  rams  are  force-summed  pro- 
viding a single  point  command.  The  CVUs  monitor  the  status  of  each  SA  and 
will  shut  down  any  individual  unit  which  is  determined  to  have  a significantly 
different  differential  hydraulic  pressure  than  the  differential  hydraulic 
pressures  of  the  other  imits  of  that  SA.  Reset  switches  with  integral  status 
Indicator  lights  are  Installed  on  the  main  Instrument  panel  of  the  test  air- 
craft to  provide  continuous  system  status  information.  Momentary  or  inadver- 
tent failures  can  be  reset  using  these  switches. 

An  extensive  ground  Built-In-Test  (BIT)  capability  is  included  in  the 
SFCS.  The  system  automatically  tests  the  SFCS  with  several  hundred  separate 
functional  tests  and  subsequently  indicates  a GO  or  NO  GO  condition  to  the 
pilot  and  ground  crew.  Most  detected  failures  are  automatically  isolated 
to  a specific  Line  Replaceable  Unit  (LRU) . LRU  failure  Indications  are 


Figurelj.  Survivable  Flight  Control  System  Mechanization 
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displayed  on  a maintenance  test  panel.  In  addition,  the  test  number  of  any 
failed  test  is  indicated  to  further  help  locate  where  in  an  LRU  the  failure 
occurred.  The  ground  BIT  requires  approximately  four  minutes,  and  is  posi- 
tively deactivated  during  flight. 


INSTRUMENTATION  AND  DATA  ACQUISITION  SYSTEM 


The  data  acquisition  system  consisted  of  various  instrumentation  compo- 
nents located  in  the  nose  area  of  the  test  aircraft.  The  system  included  an 
Ampex  AR  200  14  track  magnetic  tape  recorder,  PDM  multicoders,  proportional 
NBFM  multiplexing  equipment,  power  supplies,  and  signal  conditioning  elec- 
tronics. An  L-Band  UHF  telemetry  system  was  located  in  the  center  fuselage 
upper  equipment  bay.  Approximately  275  data  measurands  were  recorded  during 
the  initial  SFCS  flights.  Certain  measurands  such  as  component  temperatures 
and  multichannel  SFCS  performance  monitoring  were  deleted  from  the  instru- 
mentation once  adequate  data  had  been  accumulated. 


FLIGHT  TEST  APPROACH 


Flight  testing  of  the  SFCS  was  initiated  on  29  April  1972  from  the 
contractor's  facility  in  St.  Louis  and,  on  5 July  1972,  transferred  to  their 
Edwards  AFB  facility  for  further  flight  envelope  expansion.  Flight  testing 
was  structured  into  four  progressive  phases. 

The  first  phase  consisted  of  27  flights,  providing  23  hours  of  FEW  flight 
time,  and  used  to  develop  and  evaluate  the  FBW  flight  control  for  all  three 
axes  while  retaining  a mechanical  backup  (MBU)  system  for  the  pitch  and  di- 
rectional axes.  During  this  phase  the  flight  envelope  and  maneuvering 
boundaries  were  progressively  expanded  to  cover  the  normal  operating  flight 
regime  of  the  F-4.  Conventional  flight  test  techniques  were  used  to  examine 
the  longitudinal  stability  and  control  as  well  as  the  lateral  directional 
mode  characteristics.  It  must  be  re-emphasized  here  that  the  program  objec- 
tives were  to  develop  and  demonstrate  a functional  SFCS,  not  to  optimize 
such  a system  for  a particular  aircraft  sudh  as  the  F-4.  For  this  reason  a 
minimal  amount  of  effort  was  expended  in  axes  optimization.  Data  was  taken 
to  investigate  the  system-component's  operational  environment  as  well  as  the 
effects  of  simulated  equipment  failures  on  the  SFCS.  Testing  of  the  MBU 
system  was  limited  to  only  that  which  was  required  to  assure  aircraft 
controllability  when  reverting  to  this  mode.  When  confidence  in  the  function- 
al operation  of  the  FBW  system  had  been  established  the  MBU  was  removed  and 
the  second  phase  of  testing  initiated. 

The  second  phase  of  testing  required  19  flights,  providing  18  hours  of 
FBW  flight  time.  This  period  was  used  to  continue  evaluation  of  the  SFCS 
perfoirmance  with  use  of  the  Normal/ Adaptive  gain  mode  of  operation.  Aircraft 
flying  qualities  for  gross  maneuvering  and  precision  of  flying  with  the  center- 
stick  and  sldestick  controller  and  vernier  control  were  evaluated  as  well 
as  simulated  combat  maneuvering,  instrument  flying,  and  various  other  mission 
oriented  tasks. 
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The  third  phase  of  system  evaluation  was  conducted  by  the  AF  Flight  Test 
Center.  A team  of  Air  Force  test  pilots  flew  15  flights  with  emphasis  on 
mission-oriented  tasks.  Testing  included  evaluations  of  stability  and  control, 
clean  and  with  external  tanks,  electrical  back-up  control,  air-to-air  and 
air-to-ground  tracking,  gross  maneuvering,  and  precision  flying.  Detailed 
test  results  of  this  portion  of  testing  have  been  documented  in  Reference  7. 

The  fourth  phase  consisted  of  a total  of  21  flights  used  for  system 
demonstration,  training  and  technology  transition.  The  21  flights  were  made 
by  thirteen  Air  Force,  Marine,  and  NASA  pilots.  All  participants  received 
back  seat  flights  and  three  demonstration  pilots  flew  two  flights  each  from 
the  front  seat.  The  flights  were  generally  designed  to  demonstrate  SFCS  per- 
formance and  functional  features,  supersonic  and  transonic  handling 
characteristics  and  maneuvering  and  precision  flying. 


SUMMARY  OF  AIRCRAFT  FLIGHT  CHARACTERISTICS 


Longitudinal  Stability  and  Control 

When  operating  in  the  Normal  FEW  mode,  pitch  control  was  generally  im- 
proved over  the  basic  F-4,  The  pitch  axis  was  better  damped  than  the  F-4  yet 
the  aircraft  still  had  adequate  short  period  response.  Pitch  short  period 
damping  ranged  from  dead-beat  to  slightly  over-damped  throughout  the  flight 
envelope.  The  SFCS  reduced  the  tendency  to  couple  with  the  short  period 
motion.  Stick  centering  was  greatly  improved  compared  to  the  F-4  resulting  in 
better  PA  configuration  speed  stability  stick  force  cues. 

The  Neutral  Speed  Stability  (NSS)  function  enhanced  the  longitudinal 
control  characteristics  by  providing  automatic  pitch  trim  to  maintain  1 g 
flight  throughout  the  flight  envelope  with  landing  gear  up.  NSS  tends  to  re- 
duce the  pilot  work  load  during  maneuvers  involving  rapid  airspeed  or  altitude 
changes  since  manual  trimming  is  not  required.  Consequently,  pitch  control 
is  improved  as  only  the  constant  maneuvering  stick  forces  are  required. 
Effectiveness  of  the  NSS  was  very  obvious  during  the  decelerating  wind-up 
turn  maneuver  through  the  transonic  area.  The  normal  F-4  nose  rise  was  not 
present  and  manual  trimming  was  not  required. 

The  centerstick  maneuvering  force  gradients  for  the  longitudinal  SFCS 
are  compared  to  the  basic  F-4  for  several  flight  conditions  as  shown  in 
Figure  4.  The  data  substantiates  pilot  comments  of  improved  maneuvering 
pitch  control  over  the  F-4,  The  SFCS  provides  a more  comfortable  stick  force 
gradient  and  stick  displacement  throughout  the  flight  envelope  allowing 
more  precise  control  of  pitch  rate  and  g.  The  improved  pitch  control  at  the 
high  g values  is  also  attributed  to  the  overall  linearity  of  the  Fs/g 
gradient  versus  g.  The  SFCS  stick  force  per  g characteristics  obtained 
from  flight  test  data  compare  favorably  with  the  predicted  values  determined 
from  earlier  studies,  analyses  and  simulations. 

Pitch  MED  gain  was  determined  to  be  optimum  for  takeoff  and  landing 
with  manual  gain  selected  in  the  FEW  Normal  mode.  Low  gain  was  then  selected 
at  275-300  knots  after  takeoff.  Takeoff  in  FEW  requires  only  a small  aft 
stick  force  to  obtain  the  stabilator  position  for  rotation  at  liftoff.  The 
application  of  aft  stick  forces  greater  than  required  for  full  stabilator 
can  delay  subsequent  nose  down  stabilator  response.  Takeoff  control  in 
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FIGURE  4 

STICK  FORCE  PER  G vs  MACH  NUMBER 
Adaptive  Gain  - Normal  Mode 

Normal  mode  is  good.  Pitch  control  is  excellent  for  landing  in  Normal  mode. 
Touch  and  go  landings  exhibited  superior  handling  qualities  and  the  presence 
of  ground  effect  was  not  detectable. 

The  aircraft  with  external  wing  tanks  installed  was  also  well  damped 
and  exhibited  no  noticeable  change  to  in-flight  characteristics  as  compared 
to  the  clean  SFCS  aircraft. 

Additional  differences  were  noted  in  longitudinal  response  characteristics 
between  the  SFCS  and  a production  F-4  aircraft.  The  SFCS  aircraft  has  a 
tendency  to  maintain  1 g during  stall  approaches,  necessitating  pilot  action 
to  push  the  nose  down  for  recovery.  The  SFCS  also  attempts  to  hold  zero 
pitch  rate  at  the  top  of  a loop  and  the  nose  must  be  pulled  down  to  complete 
the  maneuver.  Pilots  adapted  readily  to  these  differences  which  were  not 
considered  deficiencies. 


Lateral  Stability  and  Control 


During  initial  flight  tests,  the  lateral  .control  system  was  reported  to 
be  oversensitive  around  neutral  at  airspeeds  above  250  knots  in  the  cruise 
configuration.  The  control  produced  a sharp,  abrupt  first  motion  which  was 
quite  objectionable;  however,  the  response  was  not  considered  objectionable 
for  the  steady  command  inputs  required  for  gross  maneuvering.  In  an  effort 
to  reduce  this  first  motion  characteristic,  the  roll  rate  to  lateral  force 
gain  was  substantially  reduced  in  the  first  1/3  of  stick  force,  the  aileron 
over  travel  was  eliminated  and  the  spoiler  deadband  increased.  This  resulted 
in  very  sluggish  roll  response  and  was  considered  unsatisfactory. 
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Various  flight  tests  were  eonducted  in  an  attempt  to  define  roll  power 
for  small  inputs  around  neutral  for  application  to  analog  and  simulation 
studies.  Higher  than  anticipated  roll  power  for  small  deflections  was  ident'- 
Ified  as  a major  cause  of  the  high  lateral  sensitivity.  The  SFCS  Flight 
Simulator  was  utilized  extensively  to  evaluate  design  change  candidates  which, 
would  improve  the  lateral  mechanization.  Results  indicated  that  a three  grad- 
ient roll  rate  command  would  provide  the  most  desirable  lateral  characteristics. 

Since  the  three  gradient  roll  rate  command  modification  would  not  be 
available  until  Phase  two,  ah  interim  modification  was  incorporated  to  improve 
the  lateral  axis  sensitivity  characteristics.  The  modification  retained  the 
original  two  gradient  command,  but  provided  decreased  cruise  configuration 
sensitivity  and  increased  PA  configuration  sensitivity.  The  interm  modifica- 
tion, installed  for  Flights  23  through  27,  was  reported  to  be  a significant 
improvement  over  the  previous  configurations. 

The  three  gradient  roll  rate  command  modification  was  installed  during 
the  Second  Phase  layup  and  subsequently  evaluated  throughout  the  flight 
envelope.  It  was  concluded  that  the  modified  roll  command  was  an  Improvement 
over  the  two  gradient  shaping,  but  that  the  lateral  control  had  not  been  com- 
pletely optimized. 

Lateral  response  was  well  damped  at  all  flight  conditions  except  for 
small  amplitude  oscillations  at  high  q subsonic  conditions  and  there  is  no 
tendency  for  control  free  divergence.  Lateral  response  in  the  landing  con- 
figuration is  classified  as  good.  In  the  clean  configuration  above  250  knots, 
the  response  is  uncomfortably  sharp  and  becomes  objectionable  in  any  tight 
control  task  such  as  tracking  or  formation  flight.  The  problem  was  not  one 
of  roll  rate  attained  but  of  high  entry  and  recovery  roll  accelerations  and 
was  referred  to  by  the  pilots  as  "hard  starts  and  stops". 

The  high  control  application  rates  possible  with  FEW  technology  permit 
reduction  in  the  variatlqn  of  roll  time  constant  normally  experienced  as  a 
function  of  flight  condition.  The  design  aim  of  a nearly  constant  roll  rate 
time  constant  was  achieved  as  shown  in  Figure  5.  These  data  show  that  the 
SFCS  roll  time  constant  throughout  much  of  the  flight  envelope  closely  matches 
that  of  the  basic  F-4  at  high  speed,  low  altitude  flight.  This  fast  roll  re- 
sponse together  with  such  other  factors  as  stick  torquing,  linkage  nonlinear- 
ities and  high  roll  power  at  small  surface  deflections  contributed  to  the 
high  roll  accelerations. 

Roll  rate  to  stick  force  ratios  were  also  more  uniform  as  shown  in 
Figure  6.  As  illustrated  in  the  flight  test  data,  the  variation  in. roll  rate 
to  stick  force  is  substantially  reduced  as  comparied  to  the  basic  F-4  wxth 
yaw  SAS.  The  three  gradient  roll  command  shaping  provides  higher  ratios  for 
larger  commands  to  allow  maximum  roll  rates  to  be  obtained  without  excessive 
force. 

Directional  Stability  and  Control 

Directional  control  was  generally  satisfactory  throughout  the  flight 
envelope.  Short  period  damping  was  essentially  deadbeat  to  slightly  over- 
damped. The  roll-yaw  erossfeed  was  initially  weak  in  the  PA  configuration. 

The  PA  configuration  roll-yaw  crossfeed  gains  were  modified  with  Incorporation 
of  the  three-gradient  roll  command  in  the  second  phase.  Roll-yaw  crossfeed 
was  improved  for  subsequent  testing. 
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Delta  Roll  Rate  per  Delta  Stick  Force  - deg/(sec/lb) 


Mach  Number 

FIGURE  5 

ROLL  RATE  TIME  CONSTANT  SFCS  vs  F-4 


(a)  Standard  F-4E  with  Yaw  SAS  (b)  SFCS 
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FIGURE  6 

ROLL  RATE  PER  STICK  FORCE  SFCS  vs  F-4 
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General  Maneuvering 

Various  maneuvering  tests  were  accomplished  to  evaluate  FEW  control 
for  large  command  inputs.  Maneuvering  tasks  Included  360“  rolls,  Xramelmann 
turns,  transonic  decelerating  wind-up  turns  and  1/2  Cuban  Eights.  Overall, 
the  maneuvers  exhibited  control  characters it ics  which  were  improved  over  the 
basic  F-4  aircraft.  A more  positive  control  of  load  factor  was  apparent  dur- 
ing evaluation  of  wind-up  turns.  The  deceleration  through  the  transonic 
region  while  holding  load  factor  is  significantly  improved  since  the  normal 
F-4  pitch  transient  is  eliminated  by  the  blended  rate  and  acceleration  feed- 
back and  by  the  NSS  trim  function.  The  full  rolls  are  more  uniform  due  to 
the  use  of  roll  rate  feedback.  The  Immelmann  turn  was  reported  to  be  more 
comfortable  with  the  FEW  control  due  to  the  roll-to-yaw  crossfeed  effectiveness. 

Air-to-Air  and  Air-to-Ground  Tracking 

Air-to-air  and  air-to-ground  tracking  tasks  were  evaluated  by  three 
MCAIR  pilots,  two  USAF  evaluation  pilots,  and  thi^ee  USAF  demonstration  pilots. 
Qualitative  pilot  comments  varied  slightly;  however,  certain  characteristics 
were  noted  by  all  three  MCAIR  pilots.  The  CSC  was  generally  preferred  for 
tracking  by  a majority  of  the  pilots.  The  sharp  lateral  response  discussed 
previously  was  irritating  with  either  controller  for  the  tracking  task. 

When  using  the  CSC,  the  normal  tendency  to  "tighten  up"  resulted  in  torquing 
the  grip,  producing  jerky  lateral  commands.  The  SSC  provided  better  lateral 
control  in  this  respect.  However,  there  was  a tendency  to  overcontrol  in 
pitch  with  the  SSC  when  making  small  corrections.  A learning  curve  of  two 
or  three  flights  was  required  before  effective  tracking  ability  was  attained. 
Air-to-ground  tracking  was  satisfactory  with  either  controller.  Mild  side- 
slip excursions  or  drift  were  noted  on  occasions;  however,  the  ground  target 
was  regained  easily. 


SUMMABX  OF  SFCS  SYSTEM  OPERATION 


Adaptive  Gain  Changer 

This  function  operated  satisfactorily  throughout  the  program  but  it  is 
felt  that  the  complication  of  the  design  due  to  its  inclusion  was  excessive 
for  benefits  achieved.  A less  complicated  device,  using  a highly  reliable 
air  data  system,  would  probably  be  sufficient  for  most  vehicles. 

Stall  Warning  Computer 

The  stall  warning  function  was  activated  for  evaluation  on  Flight 
No.  24  and  subsequent  flights  during  the  first  phase  of  flight  testing. 
Functional  operation  of  stall  warning  was  verified  during  1 g stall  approaches 
and  wind-up  turns.  Pilots  commented  that  the  pitch  stall  warning  is  ef- 
fective in  wind-up  turns  where  significant  pilot  commands  are  being  applied. 
Its  effectiveness  is  severely  limited  in  situations  where  only  small  pitch 
commands  are  being  applied.  For  instance,  the  NSS  function  during  a 1 g 
deceleration  can  stall  the  aircraft  with  no  pilot  command  and  consequently 
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no  FBW  stall  warning  stick  force  cues.  The  nomal  F-4  audio  stall  warning 
cues  were  retained  to  supply  protection  in  this  region.  The  environment 
of  heavy  wing  rock  was  not  explored  to  assess  the  total  effectiveness  of 
stall  warning  function  in  the  lateral  feedback  loop.  Flight  data  however, 
verified  that  the  lateral  function  was  operating  satisfactorily. 

Sidestick  Controller 

Although  not  optimized  for  this  aircraft,  the  SSC  provided  an  acceptable 
means  of  control  for  all  tasks  performed  during  the  test  program.  It  was 
inherently  more  sensitive  to  pilot  inputs  than  the  centerstick,  but  a relatively 
brief  exposure  was  necessary  for  various  pilots  to  become  accustomed  to  it. 

The  controller’s  mounting  on  the  right  console  was  not  an  optimum  position 
for  precision  tasks  such  as  landing.  The  input  pivot  was  below  the  grip, 
and  coordinated  maneuvers  were  difficult  to  accomplish  at  high  load  factors. 

Reliability  and  Maintainability 

During  88.5  total  program  flying  hours,  only  5 equipment  malfunctions 
were  reported.  Four  of  these  failures  were  detected  by  BIT  prior  to  flight. 

Only  one  non-reset table  in-flight  failure,  a yaw  rate  gyro  which,  does  not 
effect  safety  of  flight,  occurred  during  the  entire  flight  test  program.  The 
calculated  probability  of  flight  control  failure,  which  is  improved  over  the 
basic  F-4,  is  10.685  x 10“7.  This  figure  does  not  consider  the  improvement 
provided  by  EBU.  Figures  on  maintenance  manhours  per  flight  hour  also  show 
improvement  in  the  SFCS  system  when  compared  to  the  F-4  mechanical  system. 

In  the  last  two  months  or  44  working  days  of  flight  testing  the  test 
aircraft  flew  31  days,  and  in  the  last  month  of  23  working  days  the  aircraft 
flew  21  days.  Of  a program  total  of  84  flights  and  88.5  flight  hours  flown 
during  10  months,  41  flights  and  42.8  flight  hours  were  flown  in  the  last  two 
months.  These  last  two  months  were  without  delays  due  to  maintenance. 


CONCLUSION 


Future  designs  envisioned  throughout  the  industry  include  such  Configu- 
ration Controlled  Vehicle  features  as  Relaxed  Static  Stability,  Direct  Lift 
Control,  Direct  Side  Force  Control,  Maneuver  Load  Control,  etc.,  which  may 
employ  canards,  movable  tails  and  movable  wing  tips.  These  features  provide 
significant  maneuvering  performance  improvements  and  control  techniques  not 
possible  with  a mechanical  control  system.  This  makes  mandatory  the  trans- 
ition from  a mechanical  control  system  to  FBW  a basic  necessity. 

This  program’s  flight  testing  has  provided  design  criteria,  reliability, 
cost  and  maintainability  data,  specification  requirements,  and  most  impor- 
tantly, the  confidence  level  required  for  installation  of  advanced  flight 
control  systems  of  this  t3^pe  in  future  aircraft. 
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DEVELOPMENT  OF  AN  ACTIVE  FLY-BY-WIRE  FLIGHT  CONTROL  SYSTEM 


Charles  A.  Anderson 
General  Dynamics  Corporation 
Convair  Aerospace  Division 
Fort  Worth  Operation 


SUMMARY 


This  paper  presents  a summary  of  the  YF-16  flight  control 
system.  The  basic  functions  of  the  flight  control  system  are 
discussed,  as  well  as  the  unique  features  such  as  Relaxed  Static 
Longitudinal  Stability  (RSS)  , Fly-By  ^Wire  (FEW),  and  Side -Stick 
Pilot's  Controller  (SSG) . In  add it ion,  the  basic  philosophy  be- 
hind the  selection  of  the  flight  control  system  functions  and 
unique  features  is  discussed. 


INTRODUCTION 


The  YF-16  is  the  first  aircraft  developed  in  which  an  Active 
Flight  Control  System  was  incorporated  from  its  inception.  In 
the  past,  the  design  of  a flight  control  system  was  undertaken 
after  the  basic  aircraft  aerodynamic  design  was  set  and  was  used 
mainly  to  improve  handling  qualities.  This  usually  involved 
little  more  than  augmenting  pitch  and  lateral-directional  damping. 
As  aircraft  handling  and  performance  requirements  increased,  so 
did  the  complexity  of  the  flight  control  system.  The  desire  to 
obtain  uniform  aircraft  response  to  pilot  commands  results  in 
command  augmentation  systems  being  used  in  the  flight  control 
system.  Since  these  systems  required  large  authority  surface 
commands  to  achieve  the  desired  response,  the  requirement  for 
highly  reliable  electronic  systems  was  generated  and  achieved. 

The  achievement  of  this  reliability  has  allowed  the  application 
of  an  Active  Control  System  in  the  YF-16. 


SYMBOLS 


A . C . aerodynamic  cen ter 


An 


normal  acceleration 


CD 

Cl 

Lowb 

I^BT 

La>j 

L3T 

LH 

M<1 

M>1 

MAC 

PT 

Ps 

RH 

RSS 

SM 

T.E. 

W 

a 

)8 

0 


drag  coefficient 
lift  coefficient 

lift  of  the  wing  body  due  to  angle  of  attack 
total  lift  of  the  wing-body- tail 
lift  of  the  tail  due  to  angle  of  attack 
lift  of  the  tail  due  to  deflection 
left-hand 

Mach  less  than  one 
^toch  greater  than  one 
mean  aerodynamic  chord 
total  pressure 
static  pressure 
right-hand 

relaxed  static  longitudinal  stability 
static  margin 
trailing  edge 
weight 

angle  of  attack 
sideslip  angle 
pitch  rate 

horizontal  tail  deflection 
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DISCUSSION 


The  design  of  flight  control  systems  has  evolved  from  purely 
mechanical  to  active  over  the  past  two  decades,  as  depicted  in  Fig- 
ure 1.  The  advent  of  high-performance  airplanes  in  the  mid-1950's 
that  were  required  to  operate  over  larger  performance  envelopes 
necessitated  the  development  of  three-axis  electronic  stability 
augmentation  systems.  Originally,  the  B-58  utilized  single-branch 
electronics  in  its  three-axis  augmentation  system.  The  following 
generation  of  airplanes,  e.g.,  the  F-111,  employed  triple -redundant 
electronics  in  stability  and  command  augmentation  system  due  to  the 
larger  authority  requirements.  However,  pilot  mechanical  controls 
were  retained  so  that  the  aircraft  could  be  flown  safely  in  the 
event  of  electronic  failures. 

Limited  FBW  functions  were  incorporated  into  control  system 
such  as  the  spoilers,  terrain  following  radar  capability  and  low 
speed  trim  compensator  on  the  F-111.  In  addition,  several  spe- 
cialized airplane  research  and  test  programs  have  used  dual,  triple 
and  quadruple  redundant  electronics  in  their  control  systems. 

These  include  the  F-4  SFCS,  G-141,  NASA  F-8,  and  TWeaD  programs. 
Since  only  single-failure  protection  is  provided  with  triple- 
redundant  electronic  systems,  an  active  control  system  must  employ 
quadruple-redundant  electronics  to  provide  the  two-failure  protec- 
tion that  is  required.  The  development  of  a quadruple-redundant 
system  has  been  a straightforward  and  low-risk  extension  of  the  10 
years  of  highly  successful  triple-redundant  electronic  application 
experience  on  the  F-111  program  and  the  quadruple-redundant  experi- 
ence gained  during  the  F-4  SFGS  program. 


The  YF-16  Gontrol  System 

The  functions  of  the  YF-16  flight  control  system  are  very 
similar  to  those  of  most  other  new  high  performance  aircraft.  The 
basic  functions  of  the  flight  control  system  that  are  common  are 
air  data  scheduled  gains,  stability  augmentation  (dynamic)  , inter- 
connects between  roll  and  yaw  axis  and  command  augmentation.  The 
unique  features  and  functions  of  the  flight  control  system  are 
static  longitudinal  stability  augmentation  (RSS) , minimum  displace- 
ment side-stick  controller  (SSG)  , total  Fly-By-Wire  implementation 
(FBW)  and  angle-of-attack  and  normal  acceleration  limiting. 
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Why  Relaxed  Static  Stability 

For  the  primary  design  mission  of  the  YF-16  - air  superiority  - 
the  importance  of  maneuverability  and  range  results  in  the  RSS  con- 
cept providing  sufficient  benefits  to  justify  its  incorporation. 

The  basic  RSS  concept  can  be  stated  in  a very  simple  way; 

1.  Balance  the  airplane  for  optimum  performance 

2.  Rely  on  the  flight  control  system  to  provide  the 
desired  level  of  static  stability  as  well  as  dynamic 
character is  tics . 

Illustrations  of  the  differences  between  a conventionally-balanced 
airplane  and  an  airplane  with  relaxed  static  stability  are  given 
in  Figures  2 and  3. 

In  the  subsonic  flight  regime  (Figure  2)  the  conventionally- 
balanced  airplane  is  shown  to  have  its  wing-body  lift  acting  for- 
ward of  the  center  of  gravity  and  the  total  lift  acting  aft  of  the 
center  of  gravity.  Since  in  a stable  system  the  moment  produced 
by  the  wing-body  lift  as  a function  of  angle  of  attack  must  be 
less  than  that  produced  by  the  tail,  the  tail  must  be  deflected 
in  a direction  to  reduce  the  total  tail  lift  in  order  to  trim  the 
system.  Therefore,  the  total  trimmed  lift  available  at  a given 
angle  of  attack  is  reduced  for  a conventionally-balanced  aircraft. 

The  RSS-balanced  aircraft  has  both  the  wing-body  and  the  total 
lift  acting  forward  of  the  center  of  gravity.  In  this  case  the 
moment  produced  by  the  wing-body  lift  as  a function  of  angle  of 
attack  is  greater  than  that  produced  by  the  tail  and  the  tail  must 
be  deflected  in  a direction  to  increase  the  total  tail  lift  in 
order  to  trim  the  system.  Therefore,  the  total  trimmed  lift  avail- 
able at  a given  angle  of  attack  is  increased  for  an  RSS  configuration 

V.  In  Figure  3,  the  same  information  is  shown  for  a supersonic 
flight  condition.  In  this  case,  both  the  conventionally-balanced 
and  RSS  airplanes  have  both  the  wing-body  and  total  lift  acting 
aft  of  the  center  of  gravity.  Because  the  RSS  airplane  has  a 
farther  aft  center  of  gravity  than  the  conventionally-balanced 
airplane,  the  down  load  on  the  tail  required  to  trim  the  system  is 
much  smaller.  Therefore,  the  RSS  aircraft  has  a higher  total  lift 
available  than  a conventional  balanced  aircraft  at  the  same  angle 
of  attack. 
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Now  what  this  all  means  is  improved  maneuverability  and  range. 
Representative  trim  requirements  for  the  conventionally-balanced 
and  RSS  configurations  are  shown  in  Figure  4 for  both  subsonic  and 
supersonic  Mach  numbers . The  benefits  that  are  obvious  from  this 
illustration  are:  (1)  higher  trimmable  lift  coefficient,  and  (2) 

lower  trim  deflections  with  attendant  drag  reduction  and  lower 
tail  loads . 

The  trimmed  drag  polars  shown  in  Figure  5 are  illustrative 
of  the  trim  drag  reduction  attributable  to  the  RSS  balance.  The 
reduced  trim  drag  results  in  higher  sustained  load  factors  and 
increased  range.  Note  that  the  benefits  are  most  pronounced  at 
the  higher  lift  coefficients,  which  is  an  extremely  important 
region  for  the  YF-16.  A secondary  benefit  of  the  RSS  balance  is 
a somewhat  reduced  weight  because  of  reduced  tail  loads. 


Why -F ly - By  -W  ir e ’ 

The  decision  to  employ  the  CCV  concept  of  relaxed  static  sta- 
bility (RSS)  for  the  YF-16  brought  with  it  the  responsibility  for 
providing  a reliable,  full-time-operating,  three-axis  stability 
and  command  augmentation  system.  Since  a reliable  stability  and 
command  augmentation  system  is  required,  adequate  electronic  re- 
dundancy is  necessary  to  fulfill  this  requirement.  Therefore, 
the  decision  to  be  made  is  whether  pilot  commands  should  be  trans- 
mitted via  mechanical  components  (linkage,  bellcranks,  etc.)  or 
electrical  signal  paths.  If  mechanical  components  are  chosen, 
electrical  components  are  still  involved  to  implement  the  command 
augmentation  system.  It  follows  then  that  the  retention  of  mechan- 
ical components  for  transmission  of  pilot  stick  commands  is  unjust- 
ifiable, since  an  unstable  airplane  cannot  be  controlled  in  flight 
without  the  benefit  of  a full-time-operating  stability  and  command 
augmentation  system.  Therefore,  fly-by-wire  (FBW)  is  a natural  out 
growth  of  a redundant  electronic  control  system  required  for  an 
augmentation  system  in  an  unstable  (i.e.,  RSS)  airplane. 

An  active  control  system  offers  four  benefits  which  the  YF-16 
airplane  enjoys:  (1)  precision  control  and  optimum  response;  (2) 

design  flexibility,  offering  growth  capability  and  easy  acceptance 
of  design  changes;  (3)  improvements  in  a maintainability  and  surviv 
ability  as  a result  of  simplified  equipment  installations;  and 
(4)  improved  airplane  performance,  since  the  introduction  of  CCV 
concepts  is  compatible  with  FBW. 
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How  The  Flight  Control  System  Basically  Works 

The  YF-16  quadruple-redundant  system  employs  four  inde- 
pendent signal  branches,  i.e.,  each  input  signal  source  (pilot, 
inertial  sensors,  etc.)  originates  as  four  signals,  designated 
Branches  A,  B,  C,  and  D,  This  redundancy  concept  is  depicted  for 
the  pitch  axis  only  in  Figure  6.  Each  of  the  four  branches  are 
processed  independently  in  the  Flight  Control  Computer.  This  com- 
puter contains  various  functions  which  modify  input  signals  from 
each  of  the  three  control  axes  , e.  g.,  control  d3mamics , structural 
filters,  gain-scheduling,  selectors,  power  monitors,  and  various 
interconnecting  electronic  circuitry  between  the  three  control 
axes.  Once  the  input  signals  have  been  gain -ad jus ted , filtered, 
and  amplified,  the  resulting  output  signals  are  sent  to  each  of 
the  five  large-authority,  high-response,  command  servos.  Each 
servo,  in  turn,  drives  its  respective  surface  power  actuator,  as 
shown  in  Figure  6,  The  basic  location  of  the  hardware  components 
of  the  flight  control  system  is  shown  in  Figure  7. 

I 

Flight  path  control  is  achieved  through  the  actuation  of  an 
all-movable,  differential  horizontal  tail  for  pitch  and  roll  con- 
trol, wing-mounted  flaperons  for  roll  control,  and  a conventional 
rudder  for  yaw  control.  Maneuver  capability  at  high  angles  of 
attack  is  enhanced  by  automatic  positioning  of  the  full-span  lead- 
ing edge  flap. 


Important  Design  Considerations 

The  decision  to  employ  an  active  control  system  in  lieu  of 
a conventional  control  system  required  the  addressing  of  several 
important  design  considerations  peculiar  to  these  systems.  These 
include:  electronic  circuit  failure  monitoring,  electrical  power 

failures,  engine  failures,  command  servos,  surface  actuators,  and 
branch  separation. 

When  employing  redundant  electronic  systems,  consideration 
must  be  given  to  the  problem  of  proper  signal  selection  and  fail- 
ure monitoring.  The  F-111  airplane  utilizes  triple-redundant 
electronics  with  middle-value  signal  selection.  With  more  than 
350,000  aircraft  flight  hours,  there  has  been  only  one  known  dual 
electronic  failure  experienced.  (The  pilot  landed  the  airplane 
without  incident).  With  reliance  on  demonstrated  operational  ser- 
vice, the  YF-16,  quadruple -redundant  system  likewise  utilizes 
middle-value  signal  selection  on  the  processed  input  commands 
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(which  result  from  the  four  separate  electronic  branches)  that  are 
ready  for  outputs  to  the  command  servos.  To  illustrate,  signal 
Branches,  A,  B,  and  C are  compared.  The  middle  value  is  selected 
and  then  quadrupled  so  that  four  identical  signals  are  available 
as  output  commands.  If,  for  example,  signal  Branch  B varies  a 
predetermined  amount  from  the  other  two,  then  Branch  D is  sub- 
stituted instantaneously  for  B.  If  one  of  these  three  subse- 
quently fails,  say  A,  then  the  minimum  value  signal  of  C or  D is 
chosen.  By  using  this  type  of  failure  monitoring  and  signal  se- 
lection, the  control  system  is  protected  against  dual  failures. 

The  system  is  fully  protected  against  power  losses.  Multiple 
electrical  power  sources  are  provided  by  an  engine  gear  box-driven 
generator,  a standby  hydraulically-driven  generator,  and  from 
multiple  battery  power  as  a last  source.  The  standby  generator, 
hydraulically  driven  by  either  the  engine  or  emergency  power  unit 
(EPU),  is  automatically  activated  in  the  event  of  improper  genera- 
tor voltage  or  frequency.  If  both  generators  are  lost,  the 
batteries  provide  approximately  10  minutes  of  power.  The  end 
result  is  that  the  system  receives  uninterrupted  regulated  power 
with  automatic  or  manual  power  switching  capability.  In  addition 
to  the  above  normal  electrical  protection,  further  protection 
relative  to  engine  failure  is  provided  by  the  EPU  which  auto- 
matically protects  against  low  hydraulic  system  pressure. 

Another  consideration  which  is  absolutely  essential  to  the 
Successful  operation  of  an  active  control  system  is  the  conver- 
sion of  electrical  command  signals  to  mechanical  signals  for  com- 
manding each  surface  power  actuator.  Each  control  surface  is 
powered  by  a tandem  valve -on-ram  power  actuator.  In  conventional 
airplanes,  pilot  stick  and  pedal  inputs  are  summed  mechanically 
with  trim  actuator  and  damper  (stability-augmentation)  servo  in- 
puts to  command  each  power  actuator's  valve  through  conventional 
linkage.  In  the  YF-16  active  control  system,  the  inputs  are 
sximmed  electrically  and  fed  to  a command  (secondary)  servo  which 
provides  a mechanical  input  to  a power  actuator's  valve  through  a 
very  short  linkage  run,  as  indicated  in  Figures  6 and  7. 


Why  Side  Stick  Controller 

When  the  decision  was  made  to  adopt  the  fly-by-wire  feature 
of  the  control  system,  the  door  was  opened  for  simple  implementa 
tion  of  any  one  of  a number  of  new  pilot-controller  concepts. 
Should  the  control  stick  be  retained  in  the  conventional  center 
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location  or  would  it  be  more  effective  on  the  side?  Should  it  be 
a displacement  stick  or  a force-sensing  stick?  With  these  ques- 
tions in  mind,  several  studies  and  research  programs  were  under- 
taken ,to  determine  the  best  solution  for  the  YF-16. 

After  researching  SSC  installations  that  had  previously  been 
tested  on  such  aircraft  as  the  B-47,  B-26,  B-58,  F-4,  F-8,  F-104, 
F-105,  F-106,  A-4,  A-6,  A- 7,  X-15  and  others,  General  Dynamics 
built  a flight  control  simulator  to  check  out  ideas  and  designs. 

A number  of  center-stick  and  side-stick  hand  controller  designs 
were  evaluated  in  a flight  control  simulator.  Included  in  these 
were  finger-type  controllers,  palm  controllers,  conventional  grips 
with  unconventional  axes  of  rotation,  and  force-sensing  controllers 
with  both  low  and  high  feel-forces.  The  studies  and  evaluations 
showed  that  the  force-sensing,  side-stick  controller  was  superior 
to  all  of  the  other  approaches,  including  displacement  and  force- 
sensing center  sticks  and  displacement -type  side  sticks. 

The  most  widely  recognized  advantages  of  the  force-sensing 
side-stick  controller  are:  (1)  improved  high  g tracking  (based 

on  results  from  the  NASA  Langley  dual-mode  simulator  and  the  NASA 
bly-by-wire  F-8  aircraft) , (2)  improved  access  to  the  instrument 
panel  and  increased  panel  area,  (3)  ease  of  implementation  of 
pilot  inputs  in  the  computer  (electrical  signals  proportional  to 
stick  force) , and  (4)  pitch  and  roll  axes  better  oriented  to  the 
pilot's  arm  and  shoulder  muscles. 

The  fly-by-wire  aspect  of  the  flight  control  system  is  par- 
ticularly compatible  with  a force-sensing  controller.  Advantages 
of  this  combination  include:  (1)  no  linkage  dynamics  or  friction 

felt  at  the  controller,  (2)  no  linkage  balancing  problems,  (3) 
enhanced  system  survivability,  (4)  greater  freedom  in  airframe 
design  (including  ease  of  change)  , and  (5)  potential  for  weight 
and  cost  reduction. 

The  pilot's  controller  shown  in  Figure  8 is  a force-sensing 
(minimum  deflection) , side  stick,  mounted  on  and  extending  above 
the  right-hand  console.  The  location  was  developed  to  ensure  easy 
access  for  the  5th  through  95th  percentile  pilot.  An  adjustable 
arm  support  is  provided  to  enhance  pilot  control.  The  arm  support 
adjustments  are  vertical,  fore  and  aft,  and  tilt.  The  force- 
sensing  element,  which  contains  quadrex  transducers  in  both  the 
pitch  and  roll  axes  is  identical  to  the  stick-sensing  unit  em- 
ployed in  the  A- 7 aircraft,  except  for  the  level  of  redundancy 
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since  there  is  also  mechanical  linkage.  The  sensing  element  has 
been  adapted  to  an  F-111  grip. 

The  pilot  introduces  pitch  and  roll  commands  by  applying 
appropriate  forces  to  the  stick.  The  forces  imparted  to  the  stick 
by  the  pilot  cause  electrical  signals  to  be  produced  by  the  trans- 
ducers located  in  the  lower  portion  of  the  stick;  these  signals 
are  input  to  the  flight  control  computer.  The  trim  button  on  the 
top  of  the  Stick  grip  allows  the  convenient  and  conventional  input 
of  pitch  and  roll  trim  commands.  Other  stick  grip  switches  are 
provided  to  control  elements  of  the  armament  system,  nose-wheel 
steering,  and  aerial  refueling. 


Why  Angle-of -Attack  and  Normal  Acceleration  Limiting 

Since  by  definition  an  air  superiority  aircraft  is  highly 
maneuverable  over  its  entire  operting  envelope,  there  are  areas 
in  which  it  is  easy  to  obtain  large  values  of  angle-of -attack  or 
normal  acceleration.  There  are  several  ways  that  the  pilot  can 
be  protected  against  such  occurrences  rather  than  requiring  him 
to  spend  his  time  looking  at  cockpit  instruments.  One  of  these 
ways  is  to  build  in  the  required  protection  during  aircraft  design 
by  putting  on  large  enough  aerodynamic  surfaces  (i.e.,  big  verti- 
cal tail)  and  enough  structural  weight  to  assure  that  the  pilot 
cannot  spin  or  break  the  aircraft,  no  matter  what  he  does  with  the 
stick.  As  you  might  surmise,  this  approach  would  severely  penalize 
the  aircraft's  basic  performance  from  a weight  and  drag  standpoint. 

Another  method  to  protect  the  pilot  is  to  build  in  enough 
aerodynamic  resistance  to  stall  throughout  the  usable  angle-of - 
attack  range  and  enough  structural  weight  to  obtain  the  required 
"g"  plus  a 1.5  safety  factor  and  depend  on  the  pilot  to  keep  the 
aircraft  within  limits.  The  third  method  is  to  use  the  flight 
control  system  to  limit  angle-of -attack  and  normal  acceleration 
which  results  in  the  lightest,  best  performing  aircraft,  but  a very 
complex  control  system. 

For  the  YF-16  we  chose  to  use  a combination  of  methods  two 
and  three  which  resulted  in  an  aircraft  with  excellent  performance 
characteristics  with  a minimum  of  complication  in  the  flight  con- 
trol system.  Using  the  above  approach,  i.e.,  minimum  size  sur- 
fapes  and  structural  weight  combined  with  angle-of -attack  and  nor- 
mal acceleration  limiting,  has  resulted  in  a high  performance 
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fighter  type  aircraft  which  the  pilot  may  truly  maneuver  with 
"Complete  Abandon."  > 


YF-16  Flight  Test  Status 

Thirty-one  flights  have  been  made  by  YF-16  No.  1 between 
2 February  and  13  April  1974  accruing  33:45  total  flight  time 
with  1:39  being  supersonic.  Six  pilots  (2  contractor,  2 AFFTC 
and  2 TAG)  have  flown  to  date  with  USAF  pilots  making  their  first 
flights  on  flight  Nos.  4,  12,  16  and  28. 

Pilot  acceptance  of  the  advanced  technology  items,  such  as 
side  Stick  control  with  force  inputs,  fly-by-wire  flight  controls 
with  relaxed  longitudinal  aerodynamic  stability  and  maneuvering 
leading  edge  flaps,  has  been  enthusiastic.  Typical  comments  are 
"performance  and  agility  exceptional,  easily  and  precisely  con- 
trollable, impressive  roll  response  with  almost  immediate  stop  at 
release  of  stick,  comfortable  and  enjoyable  to  fly  immediately, 
no  difficulty  experienced  in  adapting  to  the  side  stick  controller." 

Confidence  in  the  redundant  active  control  system  had 
been  so  firmly  established  during  simulation,  ground  tests  and 
checkouts,  that  all  flights  (including  takeoff  and  landing)  have 
been  made  in  a statically  unstable  configuration  with  the  normal 
c.g.  for  all  flights  to  date  being  36%%  MAC  (aircraft  aerodynami- 
cally  unstable  in  pitch  at  subsonic  and  transonic  conditions). 

Some  of  the  significant  items  demonstrated  to  date  include: 

\ 

1.  Level  flight  acceleration  to  Mach  numbers  in 
excess  of  1.6 

2.  Wind-up  turns  to  7+  g's  at  subsonic  and 
supersonic  speeds 

3.  Flight  to  angles  of  attack  of  22°  at  low  sub- 
sonic speeds  and  18°  at  high  subsonic  speeds, 
and  9°  sideslip. 


Conclusions  and  Remarks 

Although  the  -YF-16  flight  control  system  :^epresents  another 
in  a long  line  of  advanced  control  system  concepts,  its  implemen- 
tation has  been  accomplished  using  current  state  of  the  art  tech- 
niques and  hardware.  The  reliability  of  the  hardware  to  date  has 
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been  exceptional  as  well  as  the  pilot's  acceptance  of  the  system. 
The  flying  qualities  and  performance  of  the  flight  control  system 
have  been  outstanding  and  we  feel  have  provided  the  Air  Force  with 
/an  outstanding  air  superiority  fighter  prototype. 
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Figure  2 SUBSONIC  BAIANCE  COMPARISON 
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Figure  3 SUPERSONIC  BAUNCE  COMPARISON 
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Figure  4 REDUCED  TRIM  REQUIREMENTS 
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Figure  5 MANEUVERABILITY  IMPROVEMENT 


ROLL  RH  HORIZ  TAIL  COWMAND  SERVO 


Figure  6 PITCH  AXIS  REDUNDANCY  CONCEPT 


Figure  8 CREW  STATION  ARRANGEMENT 
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DIGITAL  AND  FLY-BY-WIRE  SYSTEMS  ON  THE 
YF-17  LIGHTWEIGHT  FIGHTER 


J.  T.  Gallagher 
Northrop  Corporation 


ABSTRACT 


The  maneuvering  flap  control  system  on  the  YF-17,  providing  active  control  of 
lift-to-drag  ratio  and  complementing  longitudinal  and  lateral  directional  stability  , 
is  a digital  fly -by-wire  system . The  roll  control  and  directional  interconnect 
system  are  fly -by -wire  systems,  digitally  scheduled.  Since  the  basic  control 
system^on  the  airplane  is  a mechanical/hydraulic  system , it  has  been  possible  to 
use  digital,  fly-by -wire,  and  control  configured  vehicle  technology  in  a permissive 
environment  . This  paper  will  discuss  tiie  design  concept  , the  design  and  analysis 
involved  in  the  mechanization , and  the  gi’ound  and  flight  testing  of  each  of  the 
systems.  
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B-52  CONTROL  CONFIGURED  VEHICLES: 


FLIGHT  TEST  RESULTS 


James  I.  Arnold  and  Frank  B . Murphy 
The  Boeing  Company , Wichita  Division 


SUMMARY 


This  paper  summarizes  recently  completed  B-53  Control  Configured  Vehicles 
(CCV)  flight  testing,  and  compares  results  to  analytical  predictions.  Results 
are  presented  for  five  CCV  system  concepts:  Ride  Control,  Maneuver  Load  Con- 

trol, Flutter  Mode  Control,  Augmented  Stability,  and  Fatigue  Reduction,  Test 
results  confirm  analytical  predictions  and  show  that  CCV  system  concepts 
achieve  performance  goals  when  operated  individually  or  collectively. 


httroductior 

In  July  1971  the  Air  Force  Flight  Dynamics  Laboratory  (AFFDL)  initiated 
the  B-52  phase  of  the  Control  Configured  Vehicles  (CCV)  program  in  conjunction 
with  The  Boeing  Company,  Wichita  Division,  The  program  objective  was  to  vali- 
date that  the  CCV  concept  is  operationally  practical  and  results  in  significant 
performance  benefits  on  large  flexible  aircraft.  The  program  was  conducted 
under  Contract  F33615-71-C-1926  and  included  analysis,  development,  and  flight 
validation  of  four  new  CCV  system  concepts.  The  systems  developed  were:  Ride 

Control  (RC),  Flutter  Mode  Control  (FMC),  Maneuver  Load  Control  (MLC)  and  Aug- 
mented Stability  (AS),  The  Fatigue  Reduction  (FR)  system,  developed  during 
the  Load  Alleviation  and  Mode  Stabilization  (LAMS)  Program,  Reference  1,  was 
also  evaluated  during  flight  testing  to  validate  compatibility  with  the  four 
new  CCV  systems. 

The  Air  Force  participated  in  the  performance  of  the  program  by  conducting 
the  analysis  and  development  of  the  Ride  Control  concept  at  the  AFFDL  Advanced 
Development  Project  Office. 

This  paper  summarizes  the  flight  test  portion  of  the  program.  The  CCV 
tests,  completed  in  November  1973 j validate  for  the  first  time  the  CCV  system 
performance  and  compatibility  of  multiple  CCV  systems.  Actual  benefits  ob- 
tained by  flight  test  are  compared  to  the  analytical  predictions,  thereby  vali- 
dating both  the  system  performance  and  the  analytical  design  techniques. 


FLIGHT  TEST  SCOPE 


Flight  testing  was  conducted  in  two  time  periods.  The  Ride  Control  system 
was  tested  from  8 January  through  9 February  1973.  Kie  remaining  CCV  systems 
were  tested  between  18  July  and  11  November  1973.  A total  of  35  flights  were 
flown,  con^rising  122  flight  hours. 

System  Performance  Goals 

The  CCV  System  performance  goals  outlined  below  were  validated  during  the 
flight  test  program: 

• A 30  percent  reduction  in  vertical  and  lateral  RMS  acceleration  in 
turbulence  with  a Ride  Control  system 

• Meet  MIL-A-8870  flutter  damping  criteria  (g  = .03)  at  10  knots  above 
the  basic  airplane  flutter  speed  with  a Flutter  Mode  Control  system 

• Reduce  wing  root  bending  moments  during  maneuvers  with  a Maneuver  Load 
Control  system  by  8.2  x ICP  inch-pounds,  which  is  equivalent  to  a 10 
percent  reduction  in  maximum  design  load 

• Provide  acceptable  flying  qualities  at  a flight  condition  with  neutral 
static  stability  with  an  Augmented  Stability  system 

• Reduce  fatigue  damage  rates  at  critical  wing  and  fuselage  locations 
with  a Fatigue  Reduction  system 

• Meet  performance  goals  of  each  individual  system  with  multiple  CCV 
systems  operating 


Test  System  Configuration 

Analytical  studies  were  conducted  to  determine  surface  placement  and  size 
for  each  CCV  concept  and  to  evaluate  the  potential  of  various  conf  igurations  to 
meet  performance  objectives.  Existing  B-52  control  surfaces  used  for  CCV  func- 
tions are  elevators  and  rudder.  New  additional  surfaces  consist  of  three  segment 
flaperons,  outboard  ailerons,  horizontal  and  a vertical;  canard.  Figure  1 shows 
the  surface  arrangement  and  usage  for  each  concept.  The  three  segment  flaperon 
replaces  the  existing  inboard  flaps. 

The  CCV  systems  were  individually  designed  to  achieve  the  specified  per- 
formance  objectives.  Various  system  combinatiohs  were  then  analyzed  and  para- 
meters were  adjusted  as  necessary  to  meet  objectives,  A block  diagram  of  the 
five  B-52  CCV  systems  in  presented  in  Figure  2.  Die  angular  rate  and  linear 
acceleration  sensors  associated  with  these  systems  are  illustrated  in  Figure  3, 

All  new  systems  except  the  5MC  were  iirplemented  on  two  onboard  TR-48  ana- 
log conputers.  The  PMC  was  hardwired.  The  FR  system  employed  system  hardware 
developed  during  the  LAMS  program.  The  fly-by-wire  (FBN)  system,  also  devel- 
oped during  the  LAMS  program,  was  used  for  pilot  maneuver  and  flying  qualities 
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evaluations.  Figure  4 shows  the  modified  test  aircraft. 

Validation  Plan 

The  flight  validation  plan  was  structured  around  the  types  of  flight  test 
generally  required  in  any  large  flexible  aircraft  test  program.  In  addition, 
specific  flight  tests  for  math  model  accuracy  determination  were  conducted. 

Five  distinct  categories  of  tests  were  acconplished : (l)  flutter  evaluations 

to  determine  the  character  of  an  artificially  generated  flutter  mode  and  flut- 
ter mode  control  system  validation,  (2)  control  effectiveness  evaluations  to 
determine  the  aerodynamic  characteristics  of  the  new  control  surfaces,  (3)  in- 
flight  dynamic  response  evaluations  to  determine  the  accuracy  of  the  math  model, 
(4)  maneuver  testing  to  determine  flying  q.ualities  of  the  CCV  systems  and  vali- 
dation of  the  maneuver  load  control  and  augmented  stability  systems,  and  (5) 
low-level  turbulence  response  evaluation  to  validate  the  ride  control  system 
and  CCV  systems  conpatibility  with  critical  airframe  loads  and  ride  quality. 
Comparisons  of  actual  test  data  and  analysis  predictions  were  made  in  all 
categories. 

The  matrix  of  test  conditions  developed  to  evaluate  and  validate  system 
performance  is  shown  in  Figure  5,  The  three  different  fuel  configurations  are 
representative  of  a light  weight  B-52  with  normal  center-of-gravity  (c.g. ),  a 
medium  weight  B-52  with  a c.g,  7 percent  aft  of  the  current  aft  limit,  and  a 
heavy  weight  B-52  with  normal  c,g.  Selected  CCV  systems  were  evaluated  at 
various  fuel  configurations,  test  altitudes  and  airspeeds  which  best  represent 
the  true  operational  environment  on  the  B-52  aircraft. 


FMC  SYSTEM  TESTS 


To  evaluate  the  FMC  system,  a flutter  mode  (within  the  speed  capabilities 
of  the  B-52  test  vehicle)  was  created  by  adverse  ballasting  of  the  wing  drop 
tanks.  The  left  and  right  tanks,  which  normally  carry  19,500  pounds  of  fuel 
each,  were  modified  to  carry  2000  pounds  of  lead  in  the  forward  end  of  each 
tank.  At  the  21,000  foot  test  altitude,  the  ballasted  tanks  were  predicted  to 
produce  flutter  at  33O  knots  calibrated  airspeed  for  the  light  weight  test  con- 
figuration and  315  knots  calibrated  airspeed  at  the  heavy  weight  configuration. 
Flutter  was  predicted  to  be  a symmetric  second  wing  bending  and  torsion  mode  at 
2.4  Hz,  Figure  6 eomtpares  actual  speed  versus  damping  (V-g)  test  results  with 
analysis  predictions  for  the  light  weight  260,000  pound  baseline  airplane. 
Baseline  flutter  was  found  to  be  approximately  seven  percent  higher  than 
predicted  for  both  the  light  weight  and  heavy  weight  configurations. 

Figure  7 shows  the  effects  of  FMC  on  speed  versus  dangling  characteristics 
and  the  compatibility  of  other  CCV  systems  with  the  FMC.  The  test  objective  of 
flying  10  knots  past  flutter  was  achieved  at  both  gross  weights,  and  the  FMC 
met  or  exceeded  minimum  damping  requirements  of  g = .03  at  all  speeds.  The 
addition  of  other  CCV  systems  to  the  FMC  further  improved  minimium  damping  at 
all  speeds,  thus  validating  the  operational  capability  of  the  BMC  with  multiple 
CCV  systems  operating.  A comparison  of  theoretical  and  flight  test  speed- 
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damping  results  with  the  FMC  on  is  shown  in  Figure  8.  The  FMC  generally  pro- 
duced greater  danoping  than  predicted  by  analysis.  In  order  to  achieve  these 
performance  goals,  the  FMC  system  gains  were  increased  up  to  twice  nominal. 


RIDE  CONTROL  SYSTEM  TESTS 


The  Ride  Control  (rc)  system  was  validated  in  low  level  turbulence  at 
approximately  500  feet  above  the  local  terrain.  Ten  minute  data  samples  were 
recorded  for  the  baseline  airplane  and  for  the  RC  "on".  Power  spectral  density 
analyses  were  acconplished  on  the  random  data  ssimples  to  obtain  gust  response 
parameters.  Figure  9 illustrates  the  effect  of  the  RC  on  RMS  vertical  accel- 
eration along  the  aircraft  fuselage.  Results  are  also  compared  to  analytical 
predictions.  The  goal  of  30  percent  reduction  was  achieved  at  the  crew  station 
as  predicted.  Test  results  showed  less  inprovement  than  predicted  at  the  mid 
body,  and  a greater  increase  than  predicted  at  the  tail.  However,  the  proper 
trend  was  predicted.  RC  effects  on  lateral  acceleration  are  shown  in  Figure  10. 
The  goal  of  30  percent  reduction  at  the  crew  station  was  also  achieved  in  the 
lateral  axis.  Inprovements  were  greater  than  predicted  at  both  the  mid  body 
and  aft  body  locations. 

Figure  11  shows  the  change  in  aircraft  acceleration  with  multiple  CCV  sys- 
tems operating.  A 30  percent  acceleration  reduction  is  still  achieved  with  all 
systems  operating.  The  addition  of  multiple  CCV  systems  to  the  RC  generally 
produced  a further  reduction  in  aircraft  acceleration,  An  increase  in  the  air- 
plane gross  weight  by  100,000  pounds  had  no  significant  effects  on  the  RC  oper- 
ation. No  changes  were  required  to  the  system,  and  performance  goals  were 
achieved  in  the  vertical  axis,  which  was  the  only  axis  tested  at  the  heavy 
weight  condition. 

During  the  test  program,  it  became  necessary  to  increase  the  RC  system 
gains  by  a factor  of  two  in  order  to  achieve  the  performance  goals. 


MANEUVER  LOAD  CONTROL  SYSTEM  TESTS 


The  MLC  was  flight  tested  to  validate  performance  and  conpatibility  at  the 
light  weight  and  heavy  weight  airplane  configurations.  The  reduction  in  wing 
loads  was  determined  from  simulated  pilot  electrical  Inputs  introduced  to  the 
MLC  system  through  the  onboard  TR-48  analog  conputers.  Flying  qualities  were 
evaluated  for  various  pilot  maneuvers.  Although  tests  were  not  conducted  at 
the  B-52  design  load  condition  (maximum  gross  weight,  low  speed  configuration), 
the  MLC  goal  was  to  reduce  the  maximum  design  wing  root  bending  moment  by  10 
percent,  or  8.2  x 10“°  inch-pounds.  Figure  12  shows  a couparison  of  theoreti- 
cal and  flight  test  results  at  the  light  weight  low  speed  condition.  The  goal 
of  10  percent  reduction  in  maximum  design  loads  was  achieved  as  predicted. 

Comparison  of  theoretical  and  flight  test  results  for  the  MLC  are  shown 
in  Figure  13  over  a speed  range  representative  of  B-52  maneuver  operation. 
Maneuver  loads  were  significantly  reduced  over  the  speed  range. 
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Corapatibility  of  the  MLC  with  other  CCV  systems  is  illustrated  in  Figure 
l4  for  the  lightweight  medium  speed  condition.  The  addition  of  other  CCV  sys- 
tems did  not  degrade  MLC  performance  for  any  condition  tested.  No  changes  were 
required  to  the  MLC  to  meet  performance  goals. 


AUGMENTED  STABILITY  TESTS 

The  Augmented  Stability  (AS)  system  was  tested  to  evaluate  flying  quali- 
ties of  the  medium  weight  airplane  configuration  with  the  c.g.  shifted  aft  to 
the  neutral  point.  The  c.g,  was  shifted  aft  to  4l.6  percent  mean  aerodynamic 
chord  (mac)  by  adverse  fuel  distribution.  This  c.g.  location  is  7 percent  aft 
of  the  normal  B-52  aft  limit.  The  flying  qualities  were  evaluated  for  various 
types  of  pilot  maneuvers.  Figure  I5  shows  a conrparison  of  flight  test  and 
theoretical  normalized  pitch  rate  response  to  a step  column  input.  The  actual 
test  data  indicates  good  time  constant  correlation  with  less  overshoot  than 
analytically  predicted. 

Figure  16  indicates  the  decrease  in  stick  force  gradient  as  the  c.g.  was 
progressively  shifted  aft.  The  airplane  without, the  AS  system  engaged  shows 
very  light  stick  forces,  even  at  the  normal  aft  limit  of  35  percent  MAC  c.g. 
location,  indicating  a lower  than  normal  artificial  stick  force  gradient  was 
mechanized  on  the  FBN  system.  Even  with  these  lower  unaugmented  airplane  force 
gradients,  the  AS  concept  increased  the  force  gradient  a significant  amount. 
These  forces  could  have  easily  been  made  to  meet  the  criteria  by  a FBN  force 
gradient  change  and  a gain  change  within  the  pilot  command  augmentation  portion 
of  the  AS  mechanization.  Compatibility  of  AS  and  MLC  is  also  shown. 


FATIGUE  REDUCTION  SYSTEM  COMPATIBILITY  TESTS 

The  Fatigue  Reduction  (FR)  system,  validated  singly  during  the  LAMS  pro- 
gram, was  flight  tested  to  validate  compatibility  with  the  remaining  CCV  con- 
cepts. The  FR  system  was  evaluated  alone  in  low  level  turbulence  with  the 
light  weight  airplane  configuration  at  approximately  500  feet  above  the  local 
terrain.  Once  again,  as  during  the  RC  tests,  ten  minute  data  samples  were  re- 
corded for  the  baseline  airplane  and  for  the  FR  system  "on".  Power  spectral 
density  analyses  were  accomplished  on  the  random  data  samples  to  obtain  the 
gust  response  parameters.  Reduction  in  RMS  bending  moments  at  critical  wing 
and  aft  fuselage  stations  is  shown  in  Figure  17  for  the  FR  only,  as  well  as 
with  all  systems  "on"  compared  to  the  baseline  airplane.  With  all  systems  "on", 
a slight  increase  in  bending  moment  is  shown  at  the  aft  fuselage  location  com- 
pared to  the  results  obtained  with  FR  "only".  However,  the  bending  moments  are 
significantly  reduced  over  the  baseline  airplane  data. 

The  analytical  predictions  for  bending  moment  reductions  with  all  systems 
"on"  at  the  same  wing  and  fuselage  locations  are  compared  with  actual  data  in 
Figure  I8.  The  FR  compatibility  tests  generally  produced  results  greater  than 
the  analytical  predictions.  No  changes  were  required  in  the  FR  system  to 
enable  achievement  of  the  compatibility  goals. 
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CONCLUSIONS 


The  flight  test  results  from  the  B-52  CCV  program  have  validated,  for  the 
first  time,  that  significant  performance  benefits  are  achievable  when  the  CCV 
concept  is  utilized. 

The  CCV  systems  proved  to  be  operationally  practical,  both  individually 
and  collectively,  at  the  gross  weights,  airspeeds,  and  altitudes  tested. 

The  baseline  mathematical  models  and  theoretical  predictions  differed,  in 
some  cases,  from  the  actual  flight  test  data,  Even  with  these  differences  be- 
tween the  math  model  and  the  actual  airplane,  the  CCV  systems  met  their  indivi- 
dual and  collective  performance  goals  without  system  redesign.  This  result 
indicates  that  math  model  inaccuracies,  which  are  inevitable  in  any  airplane 
design  program,  can  be  conpensated  for  by  careful  and  deliberate  design  of  the 
CCV  systems,  Sinple  gain  changes,  such  as  those  required  during  the  EMC  and  RC 
flight  tests,  to  enable  a system  or  combination  of  systems  to  meet  the  perfor- 
mance goal  are  considered  to  be  a minor  modification. 

The  results  of  the  B-52  CCV  program  indicate  that  existing  analysis  tech- 
niques and  performance  prediction  methods  are  indeed  sufficiently  accurate  to 
permit  incorporation  of  CCV  concepts  into  future  large  aircraft  designs. 


FUTURE  RESEARCH 

As  pointed  out  in  Reference  2,  the  basic  criteria  for  establishing  accep- 
tance of  a new  technology  such  as  CCV  is  that:  (l)  the  system  meet  predicted 
performance,  (2)  the  system  be  operationally  practical,  (3)  the  system  be  re- 
liable and  safe,  and  (4)  that  it  be  cost  effective.  The  B-52  CCV  program  has 
contributed  significantly  in  establishing  acceptance  of  CCV  for  large  military 
aircraft  by  validating  that  predicted  performance  can  be  achieved  over  a 
limited  operational  range. 

Future  research  efforts  should  primarily  be  concentrated  in  the  two  re- 
maining areas.  Since  CCV  technology  is  dependent  on  the  concept  of  fly-by-wire, 
efforts  should  be  focused  on  development  of  a highly  reliable  fly-by-wire  sys- 
tem for  large  flexible  aircraft.  To  validate  that  the  technology  is  safe  and 
cost  effective,  a technology  demonstrator  aircraft  is  needed  which  incorporates 
the  full  concept  of  CCV  in  the  preliminary  design.  This  test  vehicle  should  be 
configured  to  demonstrate  total  dependence  of  the  structural  and  aerodynamic 
design  on  the  CCV  concept. 


\ 
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Figure  4.-  B-52  CCV  Test  Aircraft 
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AN  OVERVIEW  OF  NASA'S  DIGITAL  FLY-BY-WIRE 
TECHNOLOGY  DEVELOPMENT  PROGRAM 


Calvin  R . Jarvis 
NASA  Flight  Research  Center 


SUMMARY 


The  feasibility  of  using  digital  fly-by-wire  systems  to  control  aircraft  was 
demonstrated  by  developing  and  flight  testing  a single  channel  system , which  used 
Apollo  hardware , in  an  F-8C  test  airplane , This  is  the  first  airplane  to  fly  with  a 
digital  fly-by-wire  system  as  its  primary  means  of  control  and  with  no  mechanical 
reversion  capability . The  development  and  flight  test  of  a triplex  digital  fly-by- 
wire  system  , which  will  serve  as  an  experimental  prototype  for  future  operational 
digital  fly-by-wire  systems,  is  underway. 


INTRODUCTION 


The  advantages  of  digital  fly-by-wire  (DFBW)  systems  in  terms  of  control 
system  flexibility  and  reliability  were  demonstrated  for  spacecraft  applications  in 
NASA's  manned  space  program.  However,  the  transfer  of  this  technology  from 
spacecraft  to  aircraft  is  not  direct  and  will  require  the  identification  and  solution 
of  many  problems . 

DFBW  technology , when  fully  utilized  in  the  flight  control  system  of  an  air- 
craft, can  provide  significant  advantages  over  conventional  control  systems  in 
terms  of  reduced  costs , weight , and  volume , and  in  improved  performance . A 
redundant  digital  system , which  can  identify  in-flight  system  failures  and  recon- 
figure itself,  offers  a potential  reliability  comparable  to  that  of  the  basic  aircraft 
structure  as  well  as  the  advantages  of  automatic  control  techniques  . 

Although  these  benefits  cannot  be  easily  quantified  for  all  classes  of  aircraft , 
design  studies  do  indicate  major  rewards  in  terms  of  more  effective  flight  control 
systems  and , thus , more  effective  aircraft . But  even  more  important , these  sys- 
tems lay  the  ground  work  for  active  control  technology , and  it  is  the  active- 
control-configured  aircraft  that  offers  the  greatest  potential  in  economic  gains  and 
performance  advancements . 
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The  overall  objective  of  NASA’s  digital  fly-by-wire  program  is  to  provide  the 
foundation  for  this  technology , in  terms  of  design  criteria  and  operational  experi- 
ence , which  will  lead  to  the  development  of  practical  digital  fly -by-wire  systems 
for  future  aircraft.  To  accomplish  this  objective,  the  program  was  separated  into 
two  phases,  with  an  F-8C  airplane  (fig.  1)  used  as  the  test  vehicle. 

The  goal  of  Phase  I,  which  has  been  accomplished,  was  to  demonstrate  the 
feasibility  of  using  a DFBW  system  as  the  primary  flight  control  system  of  an  air- 
craft. To  accomplish  this  goal,  a single  channel  DFBW  primary  flight  control  sys- 
tem was  flight  tested  , using  an  analog  backup  control  system  for  fail/safe  redun- 
dancy . 

The  goal  of  Phase  II  is  to  establish  a design  base  for  the  development  of  prac- 
tical DFBW  systems . This  will  Involve  the  development  and  flight  test  of  a triplex 
DFBW  system  using  redundancy  management  and  data  bus  concepts. 

Figure  2 shows  the  schedule  for  Phases  I and  II.  The  major  aspects  of  each 
phase  are  discussed  in  the  following  sections . 


SINGLE  CHANNEL  SYSTEM  DEVELOPMENT 


To  establish  the  feasibility  of  the  DFBW  concept , a system  was  designed  to 
replace  the  basic  mechanical  primary  flight  control  system  of  the  F-8C  test  airplane 
in  all  three  control  axes.  All  mechanical  connections  linking  the  pilot's  control 
stick  and  rudder  pedals  to  the  control  surfaces  were  removed . To  be  compatible 
with  fly-by-wire  design  philosophy  and  development  practice,  no  mechanical 
reversion  capability  was  provided  even  during  the  first  part  of  the  flight-test  pro- 
gram. This  is  particularly  significant  because  it  required  that  satisfactory  design 
and  test  techniques  be  demonstrated  before  the  first  flight . A single  channel 
digital  system  concept  was  selected  as  the  most  straightforward  approach  to  estab- 
lishing system  feasibility . 

To  minimize  cost  and  development  time , digital  hardware  and  software  orig- 
inally developed  for  the  Apollo  program  were  used  as  the  heart  of  the  digital  sys- 
tem. An  Apollo  guidance  and  navigation  system  was  used  which  consisted  of  a 
digital  guidance  computer , an  inertial  measurement  unit , and  associated  interface 
elements . Use  of  this  hardware  also  made  available  highly  trained  Apollo  support 
teams , Another  factor  leading  to  the  selection  of  the  Apollo  computer  was  its 
demonstrated  70,000-hour  mean-time-before-failure  record.  This  factor  overrode 
shortcomings  of  the  hardware  which  resulted  in  some  operational  constraints . 

A more  complete  description  and  discussion  of  the  digital  system  is  presented 
in  reference  1 . Pertinent  aspects  of  man-rated  software  are  covered  in  reference  2 

To  provide  redundancy  if  the  primary  digital  system  failed , an  analog  flight 
control  system  from  a lifting  body  research  vehicle  was  modified  extensively  and 
installed  in  the  F-8C  airplane  as  a triplex  analog  backup  control  system  (ref.  3) . 
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Phase  I began  in  January  1971 , During  the  following  15  months , five  major 
contractors  took  part  in  the  development  and  flight  qualification  of  the  Phase  I sys- 
tem. These  contractors  and  their  areas  of  responsibility  were: 


Delco  Electronics  . . . . 

The  Charles  Stark  Draper  . 
Laboratory,  Inc.  (MIT) 

Sperry  Flight  Systems  Division  . 

Hydraulic  Research  and 
Manufacturing  Company 

Ling-Temco-Vought , Inc. 


. Digital  system  hardware 
. Digital  system  software 

. Analog  backup  control  system 
. Secondary  actuators 

. Aircraft  and  electrical  systems 


In  addition  to  control  law  design  and  contractor  coordination,  NASA  was 
responsible  for  specifying  the  Phase  I system  baseline  configuration  and  interface 
requirements  , verifying  the  final  software  and  hardware  flight  readiness  , and  con- 
ducting the  flight  tests . 

The  Phase  I system  was  first  used  in  flight  on  May  25,  1972.  This  was  the  first 
flight  of  an  aircraft  in  which  a digital  fly -by-wire  flight  control  system  was  the 
primary  means  of  control.  As  noted  previously,  no  mechanical  reversion  capability 
was  provided . Confidence  in  the  reliability  of  the  digital  system  was  demonstrated 
by  using  it  on  the  first  takeoff  and  landing. 

Forty-two  flights  were  made  before  the  flight  program  was  completed  in 
November  1973.  The  total  flight  time  was  58  hours.  The  pilot  controlled  the  air- 
plane most  of  this  time  using  the  primary  digital  system . Approximately  14  hours 
were  flown  using  the  analog  backup  system  for  evaluation  purposes,  inasmuch  as  no 
digital  system  failures  were  experienced  during  flight . The  flight-test  results  are 
presented  in  references  3 and  4 . 

Phase  I established  the  feasibility  of  DFBW  systems  for  primary  aircraft  control 
and  provided  flight  data  related  to  control  law  design,  software  verification,  and 
operational  procedures  for  DFBW  systems . 


MULTICHANNEL  SYSTEM  DEVELOPMENT 


The  goal  of  Phase  II  is  to  establish  a design  base  for  the  development  and  imple- 
mentation of  future  practical  DFBW  systems . To  accomplish  this  goal  a multi- 
channel system  is  being  developed  which  will  provide  redundancy  management 
flight-test  experience  and  verify  other  concepts  of  particular  concern  to  the  space 
shuttle  orbiter  development . 

The  Phase  II  system  configuration  and  major  tasks  are  discussed  in  the  follow- 
ing sections . 
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System  Configuration 


A simplified  diagram  of  the  fully  redundant  triplex  DFBW  system  is  shown  in 
figure  3 . The  principal  elements  of  the  system  are  to  be  installed  on  a removable 
pallet  assembly , as  the  single  channel  system  was  in  Phase  I . Major  components 
developed  for  Phase  I,  such  as  the  analog  backup  control  system,  redundant 
secondary  actuators , electrical  power  system , and  instrumentation  system , are  to 
be  retained  for  use  during  Phase  II . 

Dedicated , redundant  sensors  will  be  used  to  measure  airplane  angular  rate , 
attitude,  acceleration,  and  air  data.  Sensor  inputs  will  be  cross-strapped  to  each 
computer  and  synchronized  on  a bit-by-bit  basis  . Surface  command  outputs  will 
be  voted  for  fault  detection  and  supplied  to  the  triplex , force-summed , secondary 
actuator  servo  valves . Differential  pressure  equalization  will  be  used  to  minimize 
nonlinear  secondary  actuator  effects . A two  channel  (active  and  monitor)  analog 
backup  control  system  will  be  provided  for  use  if  the  primary  system  fails . 

The  system  will  be  designed  to  minimize  ground  operational  and  preflight 
support  requirements.  All  system  status  testing  will  be  automated  and  will  be  done 
onboard  the  airplane , 

'I 

The  digital  processor  selected  for  Phase  II  is  a state-of-the-art,  off-the-shelf, 
general-purpose  computer  with  floating-point  and  microprograming  features . The 
computer  is  an  order  of  magnitude  faster  than  the  Apollo  computer  used  in  Phase  I . 
The  main  storage  memory  is  fully  programable,  which  provides  greater  software 
flexibility.  This  increase  in  computer  capability  is  of  particular  importance  in 
carrying  out  the  objectives  of  the  Phase  II  program. 


Evaluation  of  Space  Shuttle  Orbiter  DFBW  Concepts 

An  important  aspect  of  Phase  II  is  coordination  with  the  shuttle  orbiter  flight 
control  system  development . In  addition  to  being  the  first  application  of  DFBW  in 
an  aerodynamic  vehicle , the  orbiter  will  contribute  significantly  to  digital  system 
technology  by  addressing  the  problems  of  redundancy  management  (reliability) 
and  overall  mechanization . 

The  shuttle  flight  control  system  will  use  the  same  digital  processors  as  those 
being  used  in  Phase  II  of  the  F- 8 DFBW  program.  The  Phase  II  triplex  processor/ 
sensor  configuration  will  thus  make  it  possible  to  evaluate  certain  aspects  of  the 
shuttle  system  by  using  the  F-8C  airplane  as  a test-bed. 

Redundancy  management.  — The  redundancy  management  concept  developed 
for  the  orbiter  system  to  detect  and  isolate  digital  processor  and  control  system 
sensor  failures  will  be  impleihented  and  flight  tested  during  Phase  II.  Because  a 
"reliable  means  of  achieving  failure  detection  and  isolation  is  a major  problem  in  the 
design  of  redundant  DFBW  systems , flight-test  verification  of  the  concepts  in 
Phase  II  will  establish  a significant  data  base  for  future  applications . 

Data  bus>^  The  data  bus  concept  of  r'educing  cabling  and  connector  require- 
ments for  redundant  systems  by  compressing  data  from  several  sensors  onto 
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redundant  transmission  lines  is  important  in  the  development  of  DFBW  technology  . 
The  discrete  format  of  signals  in  DFBW  systems  makes  the  data  bus  a natural  solu- 
tion to  the  complex  cabling  problem.  In  Phase  II  the  technique  proposed  for  the 
shuttle  system  will  be  used  to  process  trim  commands  and  mode  panel  information 
(e.g. , status  lights,  mode  change  commands)  and  to  transmit  the  information  from 
the  airplane  cockpit  to  the  palletized  system  in  the  equipment  bay  . This  will 
greatly  reduce  the  number  of  wires  and  will  verify  data  bus  utility  for  shuttle  as 
well  as  future  system  applications , 

Computer  synchronization.  — Of  major  concern  in  the  design  of  any  redundant 
DFBW  system  is  whether  or  not  to  synchronize  the  computer  operations  and , jf  so , 
the  best  way  to  do  it . The  Phase  II  system  will  be  designed  with  enough  flexibility 
to  permit  the  use  of  various  synchronization  approaches  as  well  as  asynchronous 
operation.  Included  will  be  the  baseline  approach  selected  for  the  orbiter  system. 

Control  laws . — The  first  control  laws  to  be  evaluated  in  flight  during  Phase  II 
will  be  similar  to  those  developed  for  the  F-8G  airplane  during  Phase  I and  similar 
in  format  to  those  being  developed  for  the  shuttle  orbiter . These  include  C*  and 
rate  command  modes  for  pitch  and  roll  as  well  as  direct  control  modes  for  each  axis. 
Control  law  software  required  for  moding  and  initialization  will  therefore  be  similar 
for  both  programs , which  will  permit  some  system  verification. 

Higher  order  programing  language.  — A higher  order  programing  language, 
called  Higher  Aerospace  Language  (HAL)  , is  being  developed  in  support  of  shuttle 
software  requirements  . Use  of  this  language  in  developing  certain  elements  of  the 
control  laws  for  the  Phase  II  system  will  make  it  possible  to  debug  and  verify  it 
before  it  is  actually  applied  to  the  shuttle  orbiter . 

Backup  control  system  . — The  present  shuttle  system  configuration  will  require 
a dissimilar  single  channel  digital  backup  control  system  during  initial  horizontal 
flight  tests  to  override  possible  primary  system  generic  failures . The  executive 
structure  for  the  shuttle  backup  system  will  be  implemented  in  the  Phase  II  system 
and  flight -qualified  through  flight-test  verification . 


Advanced  Control  Law  Development 

To  assess  the  capability  of  a digital  system  to  perform  the  functions  necessary 
for  future  active  control  applications , additional  control  laws  will  be  programed  and 
evaluated  during  Phase  II . A specific  task  is  the  investigation  of  improvements  that 
can  be  made  in  aircraft  control  law  implementation  as  a result  of  the  rapidly  advanc- 
ing digital  fly-by -wire  system  capability  . The  availability  of  a powerful  onboard 
digital  computer  system  that  can  process  sophisticated  flight  control  laws  in  real 
time  has  added  a new  dimension  to  realizable  control  law  development.  Control 
laws  previously  too  complex  and  unwieldy  for  analog  system  applications  can  now 
be  considered  prime  candidates  for  digital  applications . 

Initial  Phase  II  control  law  research  is  directed  toward  the  use  of  active  control 
for  maneuver  load  control,  possible  improvement  in  ride  quality  , suppression  of 
turbulence  effects,  flight  envelope  limiting  techniques,  and  operation  at  reduced 
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static-stability  margins . The  basic  elements  of  such  a control  law  now  being  devel- 
oped for  the  longitudinal  axis  are  illustrated  in  figure  4.  The  structure  consists  of 
a boundary  controller  for  angle-of-attack  limiting , a normal  controller  for  longi- 
tudinal commands , a direct-lift  controller  for  commanding  symmetric  ailerons , a 
load  controller , and  autopilot  modes . A proportional  flap-to-elevator  crossfeed  is 
planned  to  compensate  for  the  pitching  moment  produced  by  symmetric  aileron 
deflection . 

The  design  objective  for  the  longitudinal  axis  is  to  achieve  good  handling 
qualities  by  matching  desired  response  eriteria  for  both  positive  and  negative  static 
stability  margins . Gust  load  alleviation  is  provided  by  additional  damping  of  short- 
period  dynamics  using  the  elevator  surface  , Angle-of-attack  limiting  is  provided 
throughout  the  flight  envelope . 

Direct  lift  of  the  symmetric  ailerons  is  combined  with  the  elevator  to  minimize 
drag  during  maneuvers  and  to  enhance  gust  load  alleviation  during  cruise . The 
three  autopilot  modes  are  the  conventional  attitude  hold,  altitude  hold,  and  Mach 
hold. 

Other  advanced  control  law  prospects , in  which  adaptive  techniques  and  optimal 
control  theory  are  used , are  being  studied  for  possible  flight-test  evaluation  during 
Phase  II  . 


Remotely  Augmented  Vehicle  Facility 

As  part  of  Phase  II , a unique  remotely  augmented  vehicle  facility  is  to  be  devel- 
oped to  support  advanced  control  law  research  and  flight-test  evaluation  (ref  . 5) . 

A diagram  of  the  proposed  facility  is  shown  in  figure  5 . During  a test  flight , a 
special  remotely  augmented  vehicle  test  mode  may  be  selected  by  the  pilot  that  will 
divert  his  control  commands  to  a ground  computer  facility  , via  a telemetry  down- 
link, on  which  a particular  advanced  control  law  to  be  evaluated  is  programed. 
Control  surface  commands  are  determined  by  the  ground  computer  on  the  basis  of 
the  pilot’s  airborne  commands,  the  airplane’s  response,  and  the  programed  control 
law.  The  surface  commands  are  then  transmitted,  via  a telemetry  up-link,  to  the  air- 
plane system  and  the  corresponding  control  surface . The  pilot  flies  the  airplane 
through  the  control  laws  programed  on  the  remotely  located  ground  computer . Fail 
safety  will  be  maintained  through  the  use  of  reasonability  tests  built  into  the  ground 
computer  facility  and  safety  networks  in  the  telemetry  equipment . This  approach 
will  permit  a great  deal  of  flexibility  for  control  law  evaluation  without  compro- 
mising the  basic  airborne  system  verification  requirements . 


CONCLUDING  REMARKS 


The  full  realization  of  the  benefits  of  active  control  technology  and  the  benefits 
predicted  by  its  application  to  aircraft  design  depends  on  the  development  of  prac- 
tical, reliable,  and  versatile  digital  fly -by-wire  (DFBW)  control  systems.  The 
feasibility  of  such  systems  and  confidence  in  their  reliability  and  integrity  were 
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established  in  Phase  I of  the  F-8  DFBW  program . The  goal  of  Phase  II  of  the  pro- 
gram is  to  establish  a design  base  from  which  practical , reliable  systems  can  be 
developed . This  will  be  accomplished  by  developing  and  flight  testing  a fully 
redundant  triplex  DFBW  system . 

The  multichannel  system  development  carried  out  during  Phase  II  will  establish 
techniques  for  validating  redundant  system  software  and  hardware  interfaces  and 
for  establishing  operating  procedures  unique  to  DFBW  systems . Flight-test  eval- 
uation of  orbiter  control  system  concepts  using  the  F-8C  airplane  will  result  in 
verification  of  redundancy  management  software  for  digital  processor  and  sensor 
fault  detection  and  reduced  generic  failure  probabilities  for  the  orbiter  system . 

Flight-test  evaluation  of  advanced  control  laws  during  Phase  II  will  provide  an 
opportunity  to  assess  the  capability  of  DFBW  systems  to  perform  the  complex  control 
tasks  associated  with  active  control  applications . 

The  NASA  DFBW  program , although  complementary  to  other  fly-by-wire 
activities , is  aimed  specifically  at  providing  the  technology  for  practical  digital 
flight  controls  for  civil  aircraft.  As  such,  it  represents  the  first  step  toward  a new 
generation  of  active-control-configured  aircraft  which  will  offer  significant  economic 
advantages . > , 
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□ Development 
IHII  Flight  test 


Figure  2.  F-8  DFBW  program  schedule. 
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Primary  system 


Figure  3.  Phase  II  system  configuration. 


Figure  4.  Active  control  law  diagram  for  longitudinal  axis  . 
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Figure  5 . Remotely  augmented  vehicle  facility , 
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DESIGN  AND  DEVELOPMENT  EXPERIENCE 
WITH  A DIGITAL  FLY-BY-WIRE  CONTROL  SYSTEM 
IN  AN  F-8C  AIRPLANE 


Dwain  A . Deets 
NASA  Flight  Researeh  Center 

SUMMARY 


To  assess  the  feasibility  of  a digital  fly-by-wire  system , the  mechanical  flight 
-control  system  of  an  F-8C  airplane  was  replaced  with  a digital  primary  system  and 
an  analog  backup  system . The  Apollo  computer  was  used  as  the  heart  of  the  primary 
system.  This  paper  discusses  the  experience  gained  during  the  design  and  develop- 
ment of  the  system  and  relates  it  to  active  control  systems  that  are  anticipated  for 
future  civil  transport  applications  . 


INTRODUCTION 


A major  deterrent  to  the  application  of  active  controls  to  transport  aircraft  has 
been  a lack  of  experience  in  designing  highly  reliable  flight  control  augmentation 
systems  and  verifying  them  in  flight . Digital  fly -by-wire  technology  has  the 
potential  for  providing  the  necessary  reliability  while  still  offering  design  flexibility . 
To  assess  the  feasibility  of  a digital  fly-by-wire  system , the  NASA  Flight  Research 
Center  conducted  a flight  research  program  in  which  the  mechanical  flight  control 
system  of  an  F-8C  airplane  was  replaced  with  a digital  primary  system  and  an 
electrical  analog  backup  system . 

This  paper  describes  the  fly-by-wire  system  and  the  design  and  development  of 
the  digital  primary  system . The  system  and  the  design  procedures  are  assessed  in 
light  of  similar  applications  being  contemplated  for  future  transport  aircraft . 

The  paper  was  written  in  conjunction  with  references  1 to  3 , which  discuss  the 
backup  control  system , software  management , and  results  from  the  flight  tests . 


105 

miCiPING  PAGE  BT.ANK  NGT  FILMED 


SYMBOLS 


K 

KAZ 

KG 

KP 

KQ 

KR 

s 

T 


proportionality  constant 

normal  acceleration  feedback  gain  to  stabilizer  , deg/g 
stick  or  rudder  pedal  gearing  constant,  deg/m 
roll  rate  feedback  gain  to  ailerons , deg/deg/ sec 
pitch  rate  feedback  gain  to  stabilizer , deg/deg/sec 
yaw  rate  feedback  gain  to  rudder , deg/deg/sec 

pitch  rate  at  k’^”  sample  , deg/ sec 

Laplace  transform  variable 
sample  period , sec 

sT 

complex  variable , e 

■fVi 

pitch  angle  at  k ” sample 

TEST  AIRPLANE 


An  F-8C  airplane  (fig.  1)  was  selected  for  use  in  flight  testing  a digital  fly -by- 
wire system.  Several  characteristics  of  the  airplane  made  it  suitable  for  this  test 
program.  The  handling  qualities  without  control  augmentation  were  acceptable  for 
emergency  operation,  thus  backup  control  could  be  provided  through  a relatively 
simple  system.  In  addition,  the  airplane  had  enough  space  for  the  system’s  compo- 
nents, and  the  capacity  of  the  hydraulic  systems  was  adequate  . 

Some  features  of  the  F-8C  airframe  had  an  impact  on  the  fly-by-wire  system 
design.  The  variable-incidence  wing  moves  up  8°  for  low- speed  flight.  This 
rotates  the  fuselage  nose  down  relative  to  the  free  airstream  , improving  the  pilot’s 
visibility  during  the  approach.  Several  functions  within  the  flight  control  system 
are  programed  as  a function  of  wing  position . For  example , the  horizontal  stabilizer 
is  driven  5°  leading  edge  up  when  the  wing  is  raised  . 

The  F-8C  airplane  does  not  have  Independent  flap  surfaces , so  the  ailerons  are 
driven  collectively  to  serve  as  flaps  through  a mechanical  linkage  independent  of 
the  primary  control  system . For  this  program  the  linkage  was  disconnected  and  the 
ailerons  were  driven  to  the  drooped  flap  position  through  the  fly-by-wire  system  . 
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The  original  F-8C  flight  control  system  had  a direct  linkage  in  pitch  (no  augmen- 
tation) , and  roll  and  yaw  stability  augmentation  systems  (S AS)  (figs.  2(a)  and  2(b)) . 
The  yaw  SAS  included  an  aileron-to-rudder  interconnect  with  a gain  programed  as 
a function  of  stabilizer  position . 


DATA  ACQUISITION  SYSTEM 


A standard  NASA  pulse  code  modulation  (PCM)  system  was  installed  to  record 
airplane  motion , pilot  input , and  fly-by-wire  system  parameters  external  to  the 
computer . Seventy-seven  channels  of  9-bit  data  were  recorded  on  an  onboard  tape 
and  telemetered  to  a ground  station  for  real-time  monitoring.  Eight  of  the  channels 
were  digital  words  indicating  the  state  of  57  discrete  values  from  the  fly-by-wire 
system.  Although  excellent  for  automated  data  reduction,  the  PCM  system  proved 
to  be  unsuitable  for  investigating  the  effects  of  analog-to-digital  and  digital-to- analog 
quantization.  The  resolution  of  the  PCM  system  was  on  the  same  order  as  that  of  the 
digital  control  system  quantization , which  made  it  difficult  to  isolate  the  effects  of  the 
control  system  quantization. 

Internal  digital  computer  parameters  were  recorded  on  the  onboard  PCM  tape 
recorder  . One-hundred-word  pairs  were  strobed  out  every  2 seconds  and  recorded 
for  postflight  analysis . The  word  lists  were  resident  in  the  software  onboard  the 
airplane  and  could  be  reprogramed  during  the  flight  tests . This  recording  system 
was  used  primarily  to  determine  the  gross  status  of  the  computed  parameters  within 
the  flight  control  system;  the  strobe  rate  was  inadequate  for  tracing  individual 
parameters  each  control  computational  cycle . 


IRON  BIRD  SIMULATOR 


An  iron  bird  simulator  played  an  important  role  in  the  development  of  the  fly- 
by-wire system.  The  simulator  consisted  of  another  F-8C  airplane,  in  which  all  the 
digital  fly-by-wire  flight  control  hardware  was  installed , tied  in  with  a hybrid 
computer  and  appropriate  interface  equipment  (fig . 3)  . The  digital  fly-by-wire 
hardware  was  flight  qualified  and  served  as  spares  for  the  flight  vehicle . The  F-8C 
aerodynamics  and  bending  modes  were  modeled  by  using  the  digital  portion  of  the 
hybrid  computer  for  the  aerodynamics  and  the  analog  portion  for  the  bending  modes . 


FLY-BY-WIRE  SYSTEM 


The  fly-by-wire  system  had  a digital  primary  control  system  and  an  electrical 
analog  backup  control  system  . Components  of  the  fly-by-wire  system  are  shown  in 
figure  4 , and  the  location  of  the  components  in  the  F-8C  airplane  is  illustrated  in 
figure  5 . 

A simplex  digital  primary  system  and  a triplex  electrical  analog  backup  system 
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provided  enough  reliability  that  the  mechanical  system  could  be  completely  removed . 
The  digital  primary  system  consisted  of  a computer  , inertial  measurement  unit  , 
coupling  data  unit,  and  display  and  keyboard,  all  taken  from  the  Apollo  guidance 
and  navigation  system . Reference  4 provides  details  on  this  equipment  relative  to 
the  Apollo  application  . The  triplex  backup  control  system  eonsisted  of  only  surface 
position  command  electronics . Specially  designed  electrohydraulic  secondary 
actuators  interfaced  the  primary  and  backup  electronic  commands  with  the  conven- 
tional F-8C  control  surface  power  actuators. 

Components  of  the  fly-by-wire  system  were  part  of  the  primary  or  backup 
system  and , in  some  instances , were  shared  between  the  two  systems . Individual 
components  are  described  in  the  following  sections  according  to  function . 


Computational 

The  Apollo  computer  performed  all  flight  control  computations  in  the  primary 
control  system . Characteristics  of  this  computer  are  summarized  in  the  following 
tabulation: 


Read-only  memory 
Scratch  pad  memory 
Word  length  . . . . 
Number  system  . . . 
Memory  cycle  time 
Computation  time  — 

Add  

Multiply  . . . . . 
Divide  ...... 


86 , 864  words 
2 , 048  words 

14  bits  plus  sign  and  parity 
Fixed  point , ones  complement 

11 . 7  microseconds 


23.4  microseconds 

46.8  microseconds 

81.9  microseconds 


Although  slow  by  today’s  standards  , the  computer  could  perform  all  flight  control 
functions  within  30  milliseconds  . Flight  control  laws  for  the  F-8C  airplane  were 
programed  for  the  computer’s  hardwired  memory  and  could  not  be  changed  after  the 
memory  was  manufactured . However , flexibility  was  achieved  by  placing  feedback 
gains , logic  flags , digital  filter  coefficients , and  other  gain  variables  in  the 
computer’s  scratch  pad  memory  ; 105  of  these  variables  associated  with  the  flight 
control  system  could  be  changed . 

Control  laws  for  the  backup  system  were  mechanized  in  triplex  control  electronic 
boxes , which  can  be  considered  to  be  special-purpose  analog  computers . Each 
electronic  box  contained  67  operational  amplifiers , Requirements  for  high  reliability 
in  the  flight  environment  dictated  the  use  of  ruggedized  packaging  and  hardwired 
circuits . Consequently , flexibility  for  changing  control  laws  was  limited  to  gain 
and  nonlinear  constant  changes;  even  these  changes  required  replacement  of  hard- 
wired resistors  and  diodes . Although  the  control  system  is  considered  to  be  an 
analog  system,  more  than  half  of  each  electronic  box  containing  individual  channels 
of  the  analog  electronics  was  devoted  to  logic  elements , such  as  comparators  between 
the  redundant  channels . 
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Pilot  Interface 


Vehicle  control  and  trim  inputs . — The  center  stick  was  the  primary  means  of 
control  for  both  the  primary  and  the  backup  systems . It  was  connected  to  the  basic 
F-8C  mechanical  feel  system.  Disconnecting  the  mechanical  links  to  the  control 
surface  caused  undesirable  looseness  in  the  lateral  stick , so  a viscous  damper  was 
added.  Stick  position  was  sensed  through  two  separate  linear  variable  differential 
transformers  (LVDT)  in  each  axis . Each  LVDT  had  triplex  windings . Two  of  the 
windings  from  one  LVDT  in  each  axis  were  used  by  the  primary  system;  the  third 
winding  was  for  instrumentation . The  second  LVDT  provided  triplex  inputs  to  the 
backup  control  system. 

A minimum  displacement , two-axis  side  stick  was  used  as  an  alternate  controller 
input  to  the  backup  system  . This  side  stick  was  not  part  of  the  original  fly-by-wire 
system;  it  was  used  only  as  a means  of  evaluating  a "force  type"  side  stick  controller 
in  an  actual  aircraft  environment  (ref.  1) . 

The  rudder  pedals  provided  inputs  to  both  the  primary  and  the  backup  systems. 
Similar  to  the  center  stick , they  were  connected  to  the  F-8C  mechanical  feel  system 
and  used  LVDT's  for  sensing  rudder  pedal  position . 

Trim  commands  for  primary  pitch  and  roll  were  made  through  a two-axis  beeper 
switch  on  the  center  stick.  Backup  trim  inputs  in  all  three  axes  were  made  through 
separate  spring-loaded  toggle  switches  on  the  pilot' s left-hand  console . These 
toggle  switches  were  also  used  to  provide  primary  yaw  trim  and  primary  pitch  and 
roll  trim  inputs  if  the  center  stick  trim  switch  failed . When  the  side  stick  was  being 
used , trimming  was  accomplished  through  a beeper  switch  on  the  side  stick . 

Fly-by-wire  functional  control. —Figure  6 shows  the  mode  and  power  panel, 
which  was  the  pilot’s  means  of  communicating  with  the  primary  system . The  pilot 
was  able  to  choose  between  several  different  control  system  modes  simply  by 
depressing  the  appropriate  button . Additionally , he  was  able  to  change  system  gains 
according  to  the  logic  loaded  in  the  software  before  the  flight.  Several  primary 
system  failure  status  lights  were  located  across  the  top  of  the  panel , and  power 
switches  and  power  status  lights  were  located  across  the  bottom . Individual  axes 
could  be  transferred  to  backup  through  the  backup  control  system  (BCS)  switches. 
The  pilot  could  also  transfer  all  axes  to  backup  simultaneously  by  using  a "paddle 
switch"  on  the  center  stick  . 

A servo  engage  panel  on  the  left-hand  console  permitted  the  pilot  to  selectively 
engage  or  disengage  each  channel  of  each  servo  actuator . The  panel  provided 
control  over  both  the  backup  and  the  primary  systems . The  status  of  the  actuation 
system  and  the  backup  electronics  was  displayed  on  this  panel . 


Motion  Sensing  and  Interface 

Another  component  from  the  Apollo  guidance  and  navigation  system  was  the 
inertial  measurement  unit  . Although  angular  body  rates  and  linear  accelerations 
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were  not  measured  directly  in  the  Apollo  application,  the  substitution  of  aircraft 
gyros  and  accelerometers  for  the  fly-by-wire  tests  would  have  required  a major 
system  modification  and  would  have  sacrificed  the  integrity  of  the  total  Apollo 
system.  An  alternate  approach  was  adopted:  Body  rates  and  linear  accelerations 
were  computed  from  the  gimbal  angles  and  the  digital  incremental  velocity  vector 
information  the  inertial  measurement  unit  provided  to  the  Apollo  computer  for  use  in 
the  primary  system . 

A coupling  data  unit  provided  the  interface  between  the  inertial  measurement 
unit  and  the  Apollo  computer  in  the  Apollo  guidance  system  and  provided  the  same 
function  for  the  primary  system  in  the  F-8C  application.  The  angular  resolution  was 
0.011°;  however , the  rate  resolution  was  of  more  importance  and  was  nonlinear  with 
gimbal  angle  rate  . Body  angular  rate  estimation  was  directly  related  to  gimbal  angle 
rate  resolution,  Gimbal  rate  resolution  was  ±0.183  deg/sec  for  rates  less  than 
4.4  deg/ sec,  and  ±2.74  deg/ sec  for  rates  between  4.4  deg/ sec  and  70  deg/ sec,  The 
error  was  manifested  as  a random  noise  band  of  2 .74  deg/ sec  peak  to  peak  for  rates 
greater  than  4 . 4 deg/sec . Acceleration  was  sensed  by  using  pulse  integrating 
pendulous  accelerometers . The  quantization  level  for  the  normal  acceleration  sig- 
nals was  0.2g, 

The  coupling  data  unit  contained  several  digital-to-analog  converter  channels , 
which  made  it  possible  to  send  the  necessary  primary  system  commands  to  the 
control  surfaces.  To  protect  against  undetected  failures  between  the  computer  and 
the  surface  actuators,  dual  signals  were  generated  in  each  axis,  beginning  with 
dualized  commands  to  dual  digital-to-analog  converters  in  the  coupling  data  unit  in 
each  axis . The  control  surface  drive  signals  were  quantized  to  ±384  levels , which 
is  somewhat  less  than  a full  9-bit  word  . 


Control  Surface  Actuation 

Similar  actuation  systems  were  used  in  each  axis . Each  actuation  system  had  a 
secondary  actuator  and  a power  actuator  . Separate  sets  of  actuators  were  used  for 
the  left  and  right  horizontal  stabilizers  and  ailerons . A single  set  of  actuators  was 
used  for  the  rudder . 

The  hydraulic  power  actuators  from  the  basic  F-8C  airplane  were  used  without 
modification . Electrohydraulic  secondary  actuators  were  installed  to  drive  the 
metering  valves  of  each  of  the  five  power  actuators . The  secondary  actuators 
acted  as  three-chamber  force  summing  devices  when  driven  from  the  backup  system . 
The  primary  system  drove  the  secondary  actuators  through  active  monitor  servo 
valves . 

When  the  secondary  actuators  were  driven  through  the  primary  system , they 
were  stabilized  through  the  active  servo  valve  in  the  primary  system  electronics 
box.  Analog  5-hertz  low-pass  filters  were  included  in  the  primary  system  elec- 
tronics. When  driven  through  the  backup  servo  valves  , the  secondary  actuators 
were  stabilized  in  the  backup  system  electronics  packages , one  for  each  of  the  three 
backup  channels . 
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Reference  1 describes  the  actuation  systems  in  more  detail. 


Primary/Backup  System  Interface 

A functional  diagram  of  the  fly -by- wire  system  is  shown  in  figure  7 . The 
Apollo  computer  received  inputs  from  the  pilot's  stick  together  with  aircraft  motion 
information  from  the  inertial  measurement  unit.  Surface  commands  were  computed 
according  to  the  programed  control  laws  . 

The  two  drive  signals  for  each  surface  represented  commands  to  the  secondary 
actuator  position  loop , which  was  closed  with  analog  stabilization  electronics  outside 
the  Apollo  computer . As  shown  in  figure  7 , there  was  an  active  and  a monitor  servo 
path.  If  a failure  occurred  in  either  path,  a hydraulic  comparator  would  sense  the 
differential  pressure  between  the  active  and  the  monitor  servo  valve  and  transfer 
control  to  the  backup  control  system . As  long  as  the  primary  control  system  was 
operating  normally , the  backup  control  system  would  track  the  active  channel  by 
way  of  the  synchronization  network . Only  the  hydraulic  pressure  was  bypassed  at 
the  secondary  actuator , so  that  the  backup  system  was  ready  to  take  over  at  any 
time . If  a transfer  to  the  backup  system  was  requested , the  bypass  was  removed 
and  the  synchronization  network  was  disabled , resulting  in  immediate  proportional 
control  from  the  pilot's  stick.  In  the  backup  mode,  the  active  servo  valve  was 
blocked  and  the  secondary  actuator  operated  as  a force  summer  for  the  three  backup 
channels.  The  digital  computer  continued  to  operate,  computing  the  control  laws 
which  gave  the  best  estimate  of  what  the  backup  system  commanded  . If  a transfer 
to  the  primary  control  system  was  attempted , the  transient  was  small  as  long  as  the 
computer  was  tracking  the  backup  system . If  the  error  was  excessive  between  the 
primary  control  system  and  the  backup  control  system , a cross-channel  comparator 
prevented  transfer  to  the  primary  control  system . 


Fault  Detection 

Although  built-in  fault  detection  was  extremely  important  for  both  the  primary 
and  the  backup  systems,  it  was  of  particular  importance  in  the  primary  system  . 
Because  the  primary  system  was  full  authority  as  well  as  single  channel , its 
responses  could  have  been  hazardous  if  failures  were  not  handled  properly. 
Therefore , it  had  to  be  established  that  no  digital  computer  system  hardware  failure 
could  cause  a hardover  or  otherwise  hazardous  signal.  Figure  8 shows  the  type  of 
digital  system  failure  detection  used . The  Apollo  computer  had  an  extensive  and 
proved  fault  detection  and  reporting  system  which  was  built  into  the  computer 
hardware  (item  1 in  the  figure) . This  system , modified  slightly  for  application  to 
the  F-8C  airplane,  was  the  most  significant  portion  of  the  failure  detection  system. 
Some  of  the  types  of  failures  detected  were: 

Logic  circuits  — 

Parity  failed 

Program  entered  loop  and  did  not  exit 

Program  attempted  to  access  unused  read-only  memory 

Program  failed  to  check  in  occasionally 
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Analog  circuits  — 

Voltage  went  out  of  limits 

Oscillator  failed 

Timing  pulse  generator  failed 

Each  of  the  failures  caused  a restart,  that  is,  a hardware-forced  transfer  out  of  the 
control  law  program  to  a software  routine  which  performed  several  clearing  and 
initialization  steps  in  an  attempt  to  correct  the  cause  of  the  restart  before  allowing 
control  law  computations  to  continue.  For  some  restart  conditions,  a signal  was 
issued  which  caused  a transfer  to  the  backup  control  system . 

The  Apollo  computer  also  monitored  the  performance  of  the  inertial  measurement 
unit  (item  2 , fig. 8) . Written  into  the  software  were  decisions  either  to  transfer  the 
system  to  the  backup  control  system  for  serious  failures  or  to  Select  the  direct  mode 
in  the  primary  system  for  situations  such  as  an  inertial  measbrement  unit  acceler- 
ometer failure  , which  would  affect  only  certain  augmented  modes. 

Analysis  of  primary  system  failures  showed  the  need  for  additional  hardware 
failure  detection  circuitry  (item  3 , fig  8) . The  failure  of  certain  channel  outbits 
not  monitored  by  the  Apollo  computer , in  combination  with  normal  pilot  reactions , 
could  have  led  to  hazardous  situations . ThesS  conditions  first  became  apparent  in 
piloted , closed-loop  simulations  using  the  iron  bird  simulator . The  necessary  hard- 
ware modifications  were  made  and  implemented  in  the  system  to  circumvent  these 
failure  conditions  or  to  cause  a transfer  to  the  backup  control  system  when  prevention 
was  not  possible. 

Built-in  test  equipment  for  the  backup  system  and  primary  electronics  was 
provided  in  the  pilot’s  side  console.  This  self-test  equipment  could  be  activated 
only  during  preflight  tests  (ref  , 1) . 


FLIGHT  CONTROL  SOFTWARE 


Software  flexibility  made  it  possible  to  investigate  a multimode  F-8  digital  flight 
control  system  using  hardware  that  was  designed  for  an  entirely  different  purpose  — 
guidance  and  navigation  in  space . The  structure  of  the  primary  system  control  laws , 
which  were  implemented  through  software  , and  the  associated  logic  functions  are 
described. 


Control  Law  Modes 

Control  in  each  axis  was  provided  in  the  control  laws . The  simplest  form  in 
each  axis  was  the  direct  mode , illustrated  in  figure  9 . The  control  law  structure 
and  gain  settings  were  selected  to  be  as  close  as  possible  to  those  of  the  backup 
control  system.  The  first  level  of  augmentation  was  rate  feedback  in  the  pitch  and 
roll  axes . Figure  10  illustrates  these  SAS  modes  as  they  were  during  flight  tests . 
In  the  yaw  axis  , an  aileron -to -rudder  interconnect  was  included  in  addition  to  the 
yaw  rate  feedback  (fig.  11) . The  most  advanced  type  of  control  law  was  a blended 
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pitch  rate  and  normal  acceleration  command  augmentation  mode , illustrated  in 
figure  12. 

The  sampled-data  aspect  of  the  digital  fly-by-wire  system  significantly  affected 
the  implementation  of  the  software.  The  pitch  SAS  mode,  illustrated  in  figure  13, 
was  representative  of  the  other  augmented  modes . A multirate  sampling  system  was 
used,  with  a major  cycle  sample  time,  T,  of  30  milliseconds  and  a minor  cycle 
sample  time , 3T , of  90  milliseconds . Gimbal  angles  were  transformed  to  body  angles 
by  uging  sines  and  cosines  of  gimbal  angles  updated  once  every  minor  cycle.  A 
second-order  rate  estimator  operating  on  these  gimbal  angles  provided  body  rates , 
which  were  then  filtered . General-purpose  digital  filters  were  programed  so  that 
different  characteristics  could  be  selected  independently  for  each  feedback  parameter . 
Proper  selection  of  the  difference  equation  coefficients  could  provide  a wide  range 
of  filter  characteristics . A first-order  prefilter , a dead  band , and  a parabolic 
nonlinear  gradient  were  available  to  shape  the  pilot’s  input. 


Logic  Functions 


An  important  capability  made  possible  through  software  was  the  integration  of 
logic  statements  in  the  control  law  code.  Logic  statements,  even  though  complex, 
were  easily  written  into  the  software . Had  the  system  been  analog  rather  than 
digital,  special-purpose  hardware  would  have  been  necessary  to  perform  the  same 
logic  functions . One  mode  logic  function  associated  with  the  yaw  axis  is  discussed 
in  reference  5 . 

Another  type  of  logic  function  was  the  software  reasonability  test  which  was 
applied  to  each  surface  command  before  it  was  sent  to  the  digital-to-analog  converter . 
If  the  new  command  differed  from  the  previous  command  by  more  than  a predeter- 
mined amount,  the  affected  axis  would  have  transferred  to  the  direct  mode.  This 
down  mode  philosophy  was  based  on  the  assumption  that  a reasonability  limit  would 
be  exceeded  because  of  generic  failures  in  the  augmentation  control  laws  rather  than 
because  of  a hardware  failure  which  would  have  affected  the  direct  mode  as  well . 

It  was  assumed  that  a hardware  failure  would  have  been  detected  by  the  built-in 
Apollo  computer  fault  detection  logic . 

Trim  inputs  were  also  tested  for  reasonability  before  the  trim  value  was  updated . 
If  a combination  of  primary  trim  commands  was  sensed  that  corresponded  to  an 
impossible  situation  for  an  unfailed  system , a failure  was  assumed , the  primary  trim 
was  deactivated,  and  an  auxiliary  trim  system  was  activated.  A test  for  runaway 
trim  was  included  which  disabled  trim  updates  if  the  trim  command  persisted  for 
more  than  3 seconds . 


DIGITAL  FLY-BY-WIRE  DESIGN 


Design  Ground  Rules 

Several  ground  rules  were  established  in  order  to  meet  the  objectives  of  the 
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program . First , the  airplane  was  to  fly  from  the  first  flight  without  mechanical 
reversion  capability . This  forced  the  designers  to  take  the  care  necessary  to 
establish  as  much  confidence  in  the  system,  including  the  software,  as  would  be 
required  for  future  active  control  applications  . Second  , the  primary  digital  system 
was  to  utilize  the  hardware  from  the  Apollo  guidance  and  navigation  system . The 
system  was  to  remain  intact;  only  software  changes  were  allowed . The  primary 
reason  for  this  requirement  was  to  retain  the  system's  high  degree  of  built-in 
integrity  and  reliability . A third  basic  design  ground  rule  established  early  in  the 
program  was  to  make  the  pilot’s  interface  with  the  computer  as  simple  as  possible. 
As  a result , the  pilot  was  given  control  over  flight  control  functions  rather  than  a 
direct  communication  with  the  computer . All  functional  changes  (for  example , a 
mode  change)  desired  by  the  pilot  were  to  be  made  through  single  switch  actions . 
This  allowed  the  pilot  to  perform  functional  changes  rapidly  and  eliminated  the 
possibility  of  Incorrect  entry  or  improper  addressing  which  could  have  had  dire 
consequences  close  to  the  ground  or  at  high  dynamic  pressure.  The  last  ground 
rule  was  to  provide  handling  qualities  that  would  be  judged  satisfactory  by  the 
pilots.  A criterion  based  on  C*  response  to  a step  pitch  stick  command  (ref . 6) 
was  used  as  a guide  during  the  design  of  the  longitudinal  control  system . Military 
Specification  MIL-F-8785B,  level  1,  was  used  during  the  lateral-directional  control 
system  design . 

These  ground  rules  had  further  implications . For  example , the  interface 
equipment  associated  with  the  Apollo  hardware  established  limits  on  the  flight 
envelope  for  satisfactory  operation.  The  analog-to-digital  converter  used  for  pilot 
stick  inputs  had  only  45  usable  discrete  levels  between  zero  and  full  stick . In  the 
pitch  axis  each  discrete  level  resulted  in  a specific  level  of  aircraft  normal  acceler- 
ation, depending  on  stick  gearing  and  dynamic  pressure.  In  this  instance,  the 
acceleration  increment  became  objectionable  to  the  pilot  within  the  basic  flight 
envelope . Thus  a new  flight  envelope  limit  was  established  at  the  dynamic  pressure 
at  which  the  stick  quantization  effect  was  not  objectionable  . Because  of  the  design 
characteristics  of  the  inertial  measurement  unit , some  additional  restrictions  were 
placed  on  the  airplane’s  maneuverability . These  included  a roll  angular  rate  limit 
of  70  deg/ sec  and  a pitch  attitude  limit  of  70° . 


Design  Synthesis  and  Analysis 

The  closed-loop  primary  system  was  synthesized  and  analyzed  by  using  two 
methods . The  first  was  an  analog  sample  and  hold  simulation  which  was  useful  in 
the  learning  process  in  that  it  pointed  out  the  more  general  aspects  of  the  digital 
control  problem.  For  example,  the  acceptable  range  of  sample  rate,  25  to  50  samples 
per  second,  was  defined.  The  effect  of  the  folding  phenomenon  of  sampled-data 
systems  on  the  structural  mode  frequencies  and  the  influence  of  common  nonlinearities 
were  also  studied  in  this  design  phase . The  second  method  used  a digital  synthesis 
program  which  provided  linear  analysis  as  a cross  check  and  a background  for  the 
sample  and  hold  simulation.  Basic  control  laws,  compensation,  and  logic  were 
established  by  using  these  two  methods . A specification  for  the  control  law  software 
was  then  formulated  , thus  providing  the  basis  for  coding  the  flight  software. 
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Design  Verification  and  Refinement 

With  the  delivery  of  portions  of  the  flight  hardware,  including  the  Apollo 
computer  and  the  coupling  data  unit,  and  early  releases  of  flight  software,  design 
verification  and  refinement  was  started . A six-degree-of-freedom  digital  aerodynamic 
model  of  the  F-8C  airplane  was  used  in  conjunction  with  the  flight  hardware  to  form 
a partial  hardware  hybrid  simulation . 

The  first  two  analysis  methods  did  not  consider  any  pilot  interface , but  the 
partial  hardware  hybrid  simulation  included  a lunar  module  hand  controller  with 
which  the  F-8C  model  could  be  crudely  flown.  Coarse  input  quantization,  a problem 
of  importance  later , did  not  become  evident  in  this  simulation  because  it  was 
completely  masked  by  the  characteristics  of  the  hand  controller . This  is  one  of  the 
major  disadvantages  of  any  simulation  which  does  not  include  major  hardware 
elements. 

Another  important  tool  in  the  design  verification  and  refinement  was  the  batch 
process  all-digital  simulation  . This  simulation  included  the  software  being  verified  , 
an  Apollo  computer  emulator , and  a program  representing  the  F-8C  aerodynamics , 
all  run  on  a large  host  computer  . Powerful  plotting  routines  made  the  internal 
computer  parameters  visible  during  each  run.  All  the  control  system  parameters 
were  examined  for  reasonableness , particularly  as  they  responded  to  mode  and  gain 
changes . One  of  the  most  useful  plots  was  duty  cycle  versus  run  time . A typical 
variation  of  duty  cycle  during  a maneuver  is  shown  in  figure  14  for  a roll  step . 
Because  of  some  additional  code  for  computation  of  stick  nonlinearities  when  the 
stick  was  displaced  from  zero , additional  computational  time  was  required  during 
this  maneuver . This  was  reflected  in  an  increase  in  the  duty  cycle,  as  shown  in 
the  figure . Other  contributions  to  duty  cycle  were  the  interrupts  from  the  motion 
sensors.  The  increase  in  roll  rate  produced  a loss  in  available  computation  time 
roughly  proportional  to  the  roll  rate . This  loss  of  computation  time  effectively 
increased  the  duty  cycle . 

The  last  step  in  the  design  verification  used  the  iron  bird  simulator . One 
problem  — the  coarse  quantization  of  the  pilot’s  stick  inputs  — was  uncovered 
immediately  . The  problem  became  obvious  once  the  hand  controller  was  replaced 
with  the  actual  center  stick . The  staircase  shape  of  the  computer  output  commands 
produced  sharp  responses  at  the  secondary  actuators  which  were  unacceptable  from 
the  standpoint  of  mechanical  motion  and  structural  element  excitation . Low-pass 
filtering  of  the  computer  output  was  undesirable  because  of  its  adverse  effect  on 
closed-loop  performance.  This  suggested  the  use  of  a digital  pilot  prefilter  that 
had  not  been  anticipated  in  the  control  law  specifications . The  flight  software  had 
already  been  substantially  verified , but  fortunately  the  read-only  memory  had  not 
yet  been  manufactured.  The  prefilter  was  quickly  programed  in  software  and  the 
code  was  reverified . Consequently , there  was  essentially  no  effect  on  the  overall 
schedule.  This  points  out  one  of  the  significant  advantages  of  a digital  flight 
control  system:  Necessary  changes  can  be  made  late  in  the  design  without  affecting 
hardware  procurement , packaging,  or  requalification.  Although  additional  software 
verification  will  be  required,  it  will  not  have  the  adverse  effect  on  program  sched- 
ules that  is  typical  of  a hardware  redesign  of  an  analog  system . 

Looking  back  on  the  various  design  and  analysis  tools , it  is  apparent  that  they 
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complemented  one  another . Confidence  in  the  system  grew  each  time  an  independent 
simulation  or  analysis  gave  results  comparable  to  those  obtained  previously  . The 
importance  of  having  the  pilot  in  the  loop  with  as  much  actual  hardware  as  possible 
was  demonstrated  vividly . In  terms  of  time  spent  on  verifying  the  various  aspects 
of  the  design  , the  largest  proportion  was  devoted  to  systematically  verifsring  each 
logic  function  and  mode  transfer  and  the  effects  of  failures  . Another  time-consuming 
aspect  was  the  refinement  of  stick  gradients  and  nonlinearities  near  zero  stick.  A 
much  smaller  proportion  of  time  was  spent  on  closed-loop  augmentation  character- 
istics , probably  because  of  the  good  agreement  generally  found  between  the  results 
from  sampled-data  analysis  methods  and  simulation  results . 


RELATIONSHIP  TO  FUTURE  APPLICATIONS 


The  configurations  of  future  fly-by-wire  systems  will  probably  be  strongly 
dependent  on  the  specific  missions  for  which  they  are  designed.  As  such,  each 
system  will  be  unique  in  some  respects , but  will  have  a large  degree  of  commonality 
with  other  fly-by-wire  systems , The  F-8  fly-by-wire  system  was  unique  in  that 
it  consisted  of  a simplex  digital  primary  system , a triplex  analog  backup  system , 
and  no  mechanical  reversion  capability.  However,  in  this  unique  system  were 
several  features  that  will  be  relevant  to  the  systems  that  will  be  required  to  achieve 
the  advantages  that  active  control  offers . These  features  were , basically , dissimi- 
lar redundancy,  single  string  software,  and  the  experience  associated  with  the 
digital  system  design. 


Dissimilar  Redundancy 


The  F-8  fly-by-wire  system  experience  with  two  dissimilar  systems  provides 
information  applicable  to  future  systems  which  are  likely  to  have  dissimilar 
redundancy.  Most  of  the  problems  were  concerned  with  the  synchronization  of  the 
two  systems . Transfers  from  one  system  to  another  were  handled  differently , but 
the  goal  was  to  minimize  transients  caused  by  the  transfer . In  each  instance , the 
system  in  control  was  tracked  by  the  other  system  so  that  transients  would  be 
minimized.  However,  the  primary  system  tracked  the  backup  system  by  estimating 
the  surface  command  of  the  backup  system  based  on  the  pilot's  control  commands 
and  trim  inputs  only.  In  transfers  from  the  primary  system  to  the  backup  system, 
the  backup  system  tracked  the  output  of  the  primary  system , Although  this 
eliminated  the  need  to  reconstruct  the  primary  system  signal  propagation  in  the 
backup  system , it  did  open  the  possibility  for  unusual  initialization  conditions  when 
the  transfer  occurred  during  an  abrupt  maneuver . Another  factor  was  that  a 
transfer  from  the  primary  system  to  the  backup  system  could  have  been  initiated 
automatically  as  a result  of  a failure , thus  the  failure  analysis  had  to  consider  all 
possible  failures  that  could  have  resulted  in  a transfer . The  timing  of  this  transfer 
was  critical  in  some  instances  when  it  could  have  coupled  with  the  pilot’s  normal 
response  to  cause  unacceptable  conditions . 

Some  aspects  of  the  dissimilar  redundant  system  gave  insight  into  redundancy 
management  problems  which  may  be  expected  in  the  future . The  backup  system 
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mechanized  the  trim  function  using  a digital  integrator  to  reduce  drift . Because  of 
differences  in  the  sampling  mechanisms  between  the  two  systems,  large  errors 
between  the  two  trim  signals  were  noted  after  extended  flight  with  the  backup 
system  in  control  in  which  numerous  trim  inputs  were  made . Figure  15  illustrates 
the  two  sampling  mechanisms . The  primary  system  sampled  trim  commands  every 
90  milliseconds.  If  trim  was  being  commanded  at  the  time  of  the  sample,  the  trim 
value  was  updated  in  the  software . The  backup  control  system  did  not  update  its 
digital  trim  integrator  until  a capacitor  was  charged  up  to  a prescribed  threshold . 
Although  the  capacitor  began  charging  the  instant  the  trim  button  was  pushed , 
approximately  175  milliseconds  were  required  before  the  first  update  of  trim . As  a 
result  of  these  two  sampling  mechanisms,  trim  inputs  of  less  than  175  milliseconds, 
but  greater  than  90  milliseconds,  caused  the  primary  system,  but  not  the  backup 
system , to  update  trim . To  correct  the  problem , there  would  have  had  to  be  either 
some  exchange  of  actual  trim  value  information  between  the  two  systems  or  some 
form  of  verification  that  one  system  received  the  trim  command  before  the  other 
system  updated  the  trim  value . Each  of  these  possible  solutions  would  have  required 
additional  connections  between  the  two  systems , which  would  have  been  undesirable 
because  they  would  have  created  new  failure  possibilities  . For  this  particular 
research  application,  a procedural  change  in  conjunction  with  close  monitoring  of 
telemetered  data  in  the  control  room  made  modification  of  the  system  unnecessary . 


Single  String  Software 

Because  a simplex  digital  system  can  have  only  a single  program  in  control  at 
one  time , it  can  be  described  as  a system  with  single  string  software . However , 
redundant  digital  systems  with  the  same  program  in  each  computer  also  effectively 
have  single  string  software.  The  experiences  with  the  F-8  digital  system  software 
are  closely  related,  then,  to  the  multichannel  digital  systems  expected  in  future 
civil  transports . Generic  software  failures  would  have  equivalent  effects  on  any 
system  with  single  string  software,  regardless  of  the  system’s  redundancy.  The 
software  controls  described  in  reference  2 suggest  that  careful  verification  will 
always  be  necessary,  but  that  the  confidence  necessary  for  man -rating  the  software 
can  be  established . 

Another  factor  that  emphasized  the  importance  of  man-rated  software  was  that 
the  single  string  software  had  full-authority  control  over  the  control  surfaces;  thus 
it  was  obviously  flight  critical . Digital  systems  will  be  called  on  to  perform  more 
and  more  flight-critical  functions  and , on  the  basis  of  our  experience , can  be 
depended  on  to  perform  with  high  integrity , 

Removal  of  all  mechanical  reversion  capability  before  the  first  flight  had  a 
significant  effect  on  the  entire  design  and  verification  process . It  forced  an 
approach  that  would  establish  complete  confidence  in  the  system  on  the  basis  of 
simulation  alone . If  the  alternate  approach  had  been  taken , that  of  retaining  a 
mechanical  link , the  most  probable  flight-test  procedure  would  have  been  to  fly  to 
a safe  altitude  using  the  mechanical  system  and  then  engage  the  fly -by-wire  system . 
After  confidence  was  gained  at  altitude  , the  more  critical  flight  safety  functions  , 
such  as  takeoff  and  landing,  would  have  been  encompassed  gradually. 
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Design  Experience 


On  the  basis  of  the  F-8  digital  fly-by-wire  design  experience , seyeral  recom- 
mendations can  be  made  regarding  the  design  of  digital  control  systems  for  future 
civil  transports . Many  of  these  recommendations  correspond  simply  to  good  design 
practice.  Analyzing  closed-loop  performance  using  standard  sampled-data  analysis 
techniques  such  as  z-plane  root  locus  can  be  relied  on  to  give  good  agreement  with 
more  complete  simulations.  Several  forms  of  simulation  and  analysis  should  be 
used  to  build  confidence  in  the  system  before  the  first  flight . A simulation  that 
includes  as  much  actual  hardware  as  possible  is  important  in  correctly  assessing 
system  performance . The  interface  with  the  pilot  is  particularly  important . 


CONCLUDING  REMARKS 


The  feasibility  of  a digital  fly-by-wire  system  was  assessed  by  replacing  the 
mechanical  flight  control  system  of  an  F-8C  airplane  with  a digital  primary  and  an 
analog  backup  fly-by-wire  system.  The  design  and  verification  procedures  which 
will  be  necessary  if  flight-critical  active  control  is  to  be  used  in  future  aircraft 
were  established  and  successfully  applied  as  part  of  the  flight  program . Careful 
application  of  standard  sampled-data  design  methods  and  systematic  verification  of 
control  system  hardware  and  software  using  complete  simulations  resulted  in  a 
digital  fly-by-wire  system  with  extremely  high  integrity.  The  successful  use  of 
single  string  software  in  a full- authority  flight  control  system  demonstrated  the 
high  level  of  Confidence  which  can  be  placed  in  digital  flight  control . 

The  experience  with  the  F-8  digital  fly-by-wire  system  pointed  up  several 
factors  that  will  be  important  in  the  successful  design  of  future  full-time  , flight- 
critical  digital  control  systems: 

(1)  Batch  process  all-digital  simulation  was  extremely  helpful  in  tracing 
internal  computer  variables  and  in  providing  visibility  to  system  response  during 
mode  changes . 

(2)  A complete  piloted  simulation  with  actual  flight  control  system  hardware 
provided  important  results  relative  to  the  pilot/stick  interface  that  had  not  been 
obtained  in  earlier  simulations  which  did  not  include  the  actual  control  stick . 

(3)  The  largest  portion  of  the  design  and  verification  effort  was  devoted  to 
logic  functions,  such  as  mode  transfers,  and  the  effects  of  failures. 

(4)  Software  changes  made  late  in  the  design  to  correct  hardware-related 
problems  had  a negligible  effect  on  the  program  schedule . 

A major  aspect  of  the  F-8  digital  fly-by-wire  system  which  will  have  application 
to  future  systems  was  its  dissimilar  redundancy  . Failure  isolation  between  the 
primary  and  the  backup  systems  was  achieved  as  desired , although  some  problems 
were  encountered  with  intersystem  synchronization . 
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(b)  Yaw-axis  damper. 


Figure  2.  Standard  F-8C  roll  and  yaw  stability  augmentation  systems. 


121 


Figure  3 . F-8C  iron  bird  simulator . 
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Figure  5 . Location  of  fly -by-wire  control  system  in 
F-8C  airplane  . 


Figure  6 . Mode  and  power  panel 
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Figfure  7 . F-8  digital  fly-by-wire  system  mechanization. 
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Figure  8 . Digital  system  failure  detection  and  reporting  system . 
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Figure  9 . Direct  modes  for  pitch , roll , and  yaw  axes . 
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Figure  13.  Pitch  stability  augmentation  system  mode  as  a sampled-data  system. 
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Figure  14 . Duty  cyele  variation  during  roll  step  maneuver . 
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Figure  15 . Trim  sampling  mechanisms  of  the  primary  and  backup  systems . 


132 


f N76-31142 


MECHANIZATION  OF  AND  EXPERIENCE  WITH  A 
TRIPLEX  FLY-BY-WIRE  BACKUP  CONTROL  SYSTEM 


. - ..  . . 'l:: 

Wilton  P , Lock  and  William  R . Petersen 
NASA  Flight  Research  Center  , 

and 

Gay  Ion  B . Whitman 
Sperry  Flight  Systems  Division 


SUMMARY 


A redundant  three-axis  analog  control  system  was  designed  and  developed  to 
back  up  a digital  fly -by -wir  e control  sy  stem  for  an  F-  8C  airplane . Forty-two 
flights , involving  58  hours  of  flight  time,  were  flown  by  six  pilots.  The  mechaniza- 
tion and  operational  experience  with  the  backup  control  system  , the  problems 
involved  in  synchronizing  it  with  the  primary  system , and  the  reliability  of  the 
system  are  discussed . 

The  backup  control  system  was  dissimilar  to  the  primary  system , and  it  pro- 
vided satisfactory  handling  through  the  flight  envelope  evaluated . Limited  flight 
tests  of  a variety  of  control  tasks  showed  that  control  was  also  satisfactory  when  the 
backup  control  system  was  controlled  by  a minimum-displacement  (force)  side  stick . 

The  operational  reliability  of  the  F-8  digital  fly-by-wire  control  system  was 
satisfactory,  with  no  unintentional  downmodes  to  the  backup  control  system  in  flight. 
The  ground  and  flight  reliability  of  the  system's  components  is  discussed. 


INTRODUCTION 


A control  system  consisting  of  a primary  digital  fly-by -wire  system  and  a dis- 
similar triplex  analog  backup  system  was  flight  tested  in  an  F-8C  airplane  by  the 
NASA  Flight  Research  Center,  The  mechanical  linkages  of  the  original  F-8C  control 
system  were  removed  except  for  cockpit  stick  and  pedal  centering  and  feel . A 
single  channel  digital  computer,  the  associated  electronics,  a power-generating 
system , and  electrohydraulic  secondary  actuators  made  up  the  primary  control 
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system  . A triplex  backup  control  system  provided  the  redundancy  required  for 
manned  flight  and  gave  the  total  system  two-failure-operate  reliability. 

The  main  components  of  the  backup  control  system  were  the  sensors , the  elec- 
tronics, and  the  secondary  actuators.  The  system  was  analog  for  signal  processing, 
had  no  feedback  for  stability  augmentation , and  was  designed  to  provide  emergency 
return-home  capability  with  airplane  handling  qualities  equal  to  those  of  the  basic 
F-8C  airplane . The  F-8C  airplane  can  be  flown  through  most  of  its  flight  envelope 
without  augmentation . 

This  paper  describes  the  backup  control  system  and  its  integration  with  the 
primary  control  system  , which  is  described  in  detail  in  reference  1 . The  mechan- 
ization of  and  operational  experience  with  the  primary  and  backup  control  systems 
are  discussed . Some  aspects  of  the  primary  and  backup  control  system  design  were 
unique;  however , many  of  the  design  features  would  apply  to  fly-by-wire  control 
systems  in  active  control  aircraft . The  reliability  of  the  total  system  during  the 
program  is  described . 

A limited  flight  test  evaluation  of  the  backup  control  system  was  conducted  using 
a minimum-displacement  (force)  side  stick  controller  for  pitch  and  roll  control . 
These  evaluations  represent  most  of  the  maneuvering  experience  with  the  backup 
control  system. 


DESIGN  FEATURES 


The  backup  control  system  was  designed  to  provide  redundancy  for  the  F-8 
digital  fly-by-wire  control  system . It  was  a triplex  analog  fly-by-wire  control- 
stick-to-control-surface  system  in  which  the  electronic  trim , sensor  and  electronics 
equalization , primary  control  system  synchronization , and  servo  and  electronics 
monitoring  were  independent  of  the  primary  control  system . The  system  incorpo- 
rated several  innovations  that  are  common  in  modern  electronics  equipment  but  not 
as  common  in  airplane  control  system  hardware . These  design  features  are 
described  in  the  following  sections . 

A functional  block  diagram  of  the  F-8  digital  fly-by-wire  control  system  is  pre- 
sented in  figure  1 . The  upper  portion  of  the  figure  is  the  primary  control  system , 
and  the  lower  portion  is  the  backup  control  system . The  secondary  actuators  are 
shared  between  the  primary  and  backup  systems , and  the  primary  control  elec- 
tronics provide  the  interface  between  the  digital-to-analog  converters  of  the  primary 
system.  The  secondary  actuators  and  the  synchronization  between  the  primary  and 
backup  systems  are  also  discussed  in  this  paper . 


Triplex  Channels 

The  backup  control  system  consisted  of  three  identical  computing  channels, 
one  for  each  airplane  control  axis . The  system  provided  an  interface  between  the 
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triplex  control  stick  and  pedal  position  sensors  and  the  triplex  servovalves.  In 
addition,  the  three  backup  control  system  channels,  including  the  sensors,  elec- 
tronics , and  servos , were  powered  by  three  isolated  power  busses  that  were 
connected  to  a common  power  source. 

The  servo  commands , which  consisted  of  stick  and  pedal  commands  that  were 
summed  with  the  trim  and  equalization  signals , were  processed  by  voters  in  each 
channel  to  insure  that  the  three  backup  channels  tracked.  The  voter  selected  the 
middle  value  of  the  three  channel  commands  to  drive  the  control  valve  in  each 
channel.  For  certain  types  of  failures  in  the  voter,  actuator,  or  servo  electronics, 
the  failed  channel  would  be  detected  and  the  servovalve  associated  with  the  failed 
channel  would  be  disengaged . Therefore , the  backup  control  system  was  opera- 
tional after  one  or  more  failures  . 


Synchronization 

An  integrator  in  each  axis  of  the  three  backup  control  system  channels  provided 
electronic  trim,  equalization,  and  synchronization.  When  a primary  channel  was 
engaged , the  backup  control  system  servo  commands  were  synchronized  with  the 
primary  servo  commands  with  these  integrators.  These  inputs  to  the  backup  con- 
trol system  voters  tracked  the  primary  channel  servo  commands , even  though 
variations  in  control  sensor  outputs  and  in  inter  system  control  laws  existed.  Con- 
tinuous synchronization  of  the  backup  with  the  primary  control  system  was  neces- 
sary to  minimize  control  surface  transients  during  the  switchover  from  the  primary 
to  the  backup  control  system . Switchover  occurred  if  there  was  a failure  in  the 
primary  system  or  if  disengagement  was  commanded  by  the  pilot . The  synchroniza- 
tion network  had  a bandwidth  of  approximately  2 . 5 hertz , 


Equalization  and  Trim 

When  the  backup  control  system  was  engaged , the  integrators  performed  the 
backup  control  system  trim  and  equalization  function . Trim  was  accomplished  by 
applying  a fixed  reference  to  the  integrator , changing  trim  at  a fixed  rate . The 
integrator  output  was  then  summed  with  the  control  stick  or  pedal  position  inputs 
to  form  the  total  surface  command.  Since  the  trim  inputs,  sensor  position  inputs , 
and  electronic  gains  were  not  necessarily  the  same  in  each  backup  control  sys- 
tem channel,  equalization  was  included  to  reduce  errors  between  channels.  Limited 
equalization,  combined  with  the  voters  , produced  essentially  identical  channel 
servo  commands  to  the  three  backup  control  system  servovalves  and  minimized  the 
force  fight  between  the  secondary  actuator  pistons . 

The  trim  and  equalization  functions  required  a low  or  zero  drift  integrator . 

The  backup  control  system  integrator  design , which  was  classified  as  having  zero 
drift , used  digital  techniques  to  accomplish  the  zero  drift  or  memory  function  and 
analog  techniques  for  the  integration  function . 
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Backup  Control  System  Monitoring 

Electronic  and  servo  signals  were  monitored  at  two  points  within  the  backup 
control  system.  The  channel  voter  output  was  compared  with  the  voter  input.  If 
the  signal  difference  was  greater  than  the  set  threshold , the  monitor  was  latched  and 
the  electronic  channel  was  reported  failed. 

The  other  monitoring  point  was  the  backup  control  system  servos . Backup  con- 
trol system  servo  monitoring  was  accomplished  by  cross-channel  comparison  of  the 
differential  pressure  signals  from  each  of  the  three  servovalves.  This  detected  ex- 
cessive force  fights  within  the  backup  control  system  servos . A preset  differenee 
in  two  of  the  three  differential  pressure  signals  resulted  in  latching  the  common 
servo  monitor , disengaging  the  failed  servo,  and  reporting  the  failure  to  the  pilot. 
When  a failure  was  detected  and  the  failed  servo  disengaged , the  resulting  surface 
transient  was  minimized  by  the  operating  characteristics  of  the  force-summed 
actuator . 


Self-Test  Procedure 

Preflight  testing  was  accomplished  by  an  automatic  self-test  procedure  that 
provided  a pseudo-end-to-end  testing  of  the  system . The  self-test  involved  the  in- 
troduction of  a logic-controlled  stimulus  and  the  disabling  of  circuit  functions  and 
used  in-flight  monitors  to  indicate  the  response . The  use  of  the  in-flight  monitors 
as  the  self-test  feedback  elements  served  to  check  the  channel  signal  paths  and  the 
operation  of  the  in-flight  monitors . This  resulted  in  a "bang-bang"  type  of  test  with 
no  indication  of  system  degradation. 

A block  diagram  of  the  self-test  unit  is  shown  in  figure  2 . The  power  for  the 
self-test  was  routed  to  the  computing  electronic  assemblies  only  after  the  self-test 
power  switch  was  closed  and  the  self-test  start  switch  was  depressed.  A counter 
started  to  count  and  addressed  the  read-only  memory , which  was  preprogramed  for 
each  particular  test  to  activate  certain  stimuli  and  disable  certain  circuits  in  the 
electronic  assemblies . The  test  results  were  compared  with  the  predicted  results , 
which  were  stored  in  the  read-only  memories  in  the  diagnostic  analysis  circuitry . 
The  self-test  automatically  stepped  to  the  next  test  if  the  test  results  were  as  pre- 
dicted . This  procedure  was  repeated  with  different  combinations  of  stimuli  and  dis- 
abling circuits  active  until  the  test  was  complete  and  a GO  signal  was  reported  in 
each  airplane  control  axis . 

If  the  test  results  from  the  electronic  assemblies  were  not  as  predicted , the 
test  sequence  was  stopped  and  a diagnostic  routine  was  initiated . The  diagnostic 
analysis  circuitry  analyzed  the  test  results  with  respect  to  the  predicted  results  to 
determine  where  the  failure  occurred . The  diagnosis  was  indicated  on  the  self-test 
diagnostic  readout . 


Status  Engage  Panel 

The  status  engage  panel  was  in  the  left  cockpit  console . It  housed  all  the 
servo  engage  switches  and  servo  status  lights  and  indicated  the  status  of  the 
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backup  control  system  electronics . The  panel  also  contained  the  self-test  program , 
power  switch , and  diagnostic  readout  to  indicate  a failed  self-test  condition  or  satis- 
factory completion  of  the  self-test . The  servo  switches  were  three-position  positive- 
action  switches  labeled  Auto-Off  and  Manual . Even  though  five  secondary  actuators 
were  utilized  for  the  three  control  system  axes,  only  three  switches  and  servo  status 
lights  were  used  for  the  three  primary  control  channels , whereas  Individual  channel 
switches  and  status  lights  were  mechanized  for  each  backup  control  valve . The 
lights  indicated  when  the  various  comparator  networks  had  exceeded  preset  values. 
The  light  was  also  a reset  switch  that  sent  a reset  pulse  to  its  comparator . The 
servo  status  lights  for  backup  servo  systems  2,3,  and  4 lit  up  after  any  two  common 
comparators  tripped . That  is , the  left  pitch  2-3  comparator  and  the  left  pitch  4-2 
comparator  lit  the  left  pitch  number  2 light  when  both  comparators  tripped.  The  logic 
for  the  primary  control  system  pitch  servos  was  that  if  either  the  left  or  the  right 
pitch  channel  indicated  failure , the  number  1 pitch  status  light  lit  , and  control  was 
switched  from  the  primary  to  the  backup  control  system . The  servo  system  logic 
was  designed  to  provide  a manual  override  capability  for  any  channel  per  actuator 
regardless  of  the  remaining  servo  system  switch  positions . 


SYSTEM  COMPONENTS 


The  approximate  locations  of  the  control  system  components  in  the  F-8  digital 
fly-by-wire  test  airplane  are  shown  in  figure  3 . As  might  be  expected , using  the 
F-8C  airplane  as  a test-bed  resulted  in  some  design  problems  that  were  unique  to 
the  F-8C  configuration . A major  problem  was  the  requirement  for  different  control 
gearing  for  the  wing-up  (approach  and  landing)  and  wing-down  (cruise)  positions . 
A pair  of  dual  wing  potentiometers  was  mounted  to  provide  an  electrical  signal  pro- 
portional to  wing  position  to  droop  the  ailerons  for  flaps  and  to  provide  automatic 
trim  of  the  horizontal  tail.  Other  system  components  that  provided  control , signal 
conditioning , and  actuation  are  described  below . 


Control 

Stick  and  pedal  transducers . — Two  transducers  that  each  contained  triplex 
redundant  linear  variable  differential  transformers  (LVDT's)  were  connected  to  the 
existing  F-8C  flight  control  linkage  to  provide  electrical  signals  as  functions  of  the 
pilot's  stick  and  rudder  commands  . One  transducer  was  provided  for  the  primary 
control  system , and  one  was  provided  for  the  backup  control  system  for  each  air- 
plane axis  of  control.  The  pitch  transducers  were  on  the  right  and  the  roll  trans- 
ducers were  on  the  left  side  of  the  airplane  underneath  the  primary  flight  pallet . 
Because  of  rudder  cable  stretch , the  two  rudder  transducers  were  installed  in  the 
base  of  the  vertical  tail . 

Each  transducer  assembly  contained  isolated  sensors  for  excitation  and  signal 
output  to  drive  as  many  as  three  separate  control  paths . All  the  transducers  were 
linear , except  for  the  pitch  transducers  for  the  backup  control  system , and  all  had 
an  electrical  stroke  of  ±1.5  centimeters  . The  pitch  transducer  for  the  backup  control 
system  transducer  had  a special  winding  to  provide  parabolic  stick  shaping  . 
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stick  and  pedal  gearing.  — An  attempt  was  made  to  duplicate  the  control  author- 
ity and  gearing  of  the  original  F-8C  airplane  in  the  F-§  digital  fly-by-wire  airplane. 
The  final  gearings  are  shown  in  figures  4(a)  to  4(c)  for  the  pitch,  roll,  and  yaw 
axes . 

The  data  presented  in  figure  4(a)  indicate  that  there  was  reasonable  agreement 
between  the  pitch  stick  gearing  of  the  fly-by -wire  airplane  and  that  of  a conven- 
tional F-8C  airplane . Only  the  wing-down  data  are  presented  for  zero  trim  command . 
With  the  wing  in  the  up  position , the  horizontal  stabilizer  surface  was  biased  5°  from 
the  wing-down  position , and  the  zero  stick  position  corresponded  to  zero  surface 
position. 

Figure  4(b)  shows  the  left  aileron  position  as  a function  of  lateral  stick  position 
for  a wing-down  and  a wing-up  configuration  with  zero  trim  command . The  gra- 
dients are  nearly  the  same  for  all  backup  control  system  commands  except  for  the 
wing-up  right  stick  command  , where  the  gradient  is  higher  than  in  the  conventional 
F-8C  airplane.  The  fly-by-wire  gradients  were  symmetrical  for  both  wing  positions, 
whereas  the  wing-up  gradient  was  not  symmetrical  (differential  aileron)  for  the  con- 
ventional F-8C  airplane . The  aileron  did  not  move  down  as  far  as  it  moved  up  for  a 
given  stick  command . 

Figure  4(c)  shows  rudder  displacement  as  a function  of  pedal  force.  Gradients 
are  shown  for  the  wing-up  and  the  wing-down  configurations . The  higher  gradient 
was  used  with  the  wing-down  configuration.  The  pedal  forces  were  provided  by  the 
existing  F-8C  mechanism . The  gradients  show  good  agreement  for  both  wing  posi- 
tions . The  backup  control  system  deadband  was  slightly  larger . 

Side  stick.  — The  side  stick  sensor  flight  tested  during  the  program  was  a two- 
axis,  four -channel,  minimum-displacement  transducer.  The  principal  of  operation 
for  the  transducer  was  that  an  applied  force  at  the  stick  grip  caused  a flexure- 
supported  tube  assembly  to  move  quadruplex  LVDT's  that  generated  a voltage  pro- 
portional to  the  applied  force.  The  side  stick  transducer  was  recessed  in  the  right 
cockpit  console  to  allow  the  pilot  to  sit  comfortably  in  the  seat  with  his  arm  in  a 
natural  position . 

Side  stick  gradients.  — The  side  stick  gradients  flight  tested  are  shown  in  fig- 
ures 5(a)  and  5(b)  for  the  pitch  and  roll  axes,  respectively.  Figure  5(a)  shows 
the  pitch  stick  force  as  a function  of  elevator  surface  position  for  both  wing  posi- 
tions. The  circuit  mechanization  consisted  of  a deadband,  a low  gradient,  and  a 
high  gradient  for  both  a pull  and  a push  force.  The  variable  high  gradient  was 
mechanized  to  function  only  with  the  wing  down , and  it  was  controlled  by  a switch 
in  the  cockpit . In  figures  5 (a)  and  5 (b) , switch  positions  increase  with  increasing 
stick  gradient . The  side  stick  authority  was  always  less  than  the  center  stick 
authority . 


Electronics 

Backup  control  system . — Three  identical  backup  control  system  electronics 
boxes  were  the  heart  of  the  backup  control  system . Each  box  contained  all  the 
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signal  processing,  engage  logic,  monitoring,  and  dc  power  necessary  for  a single 
backup  control  system  channel  in  the  pitch,  roll,  and  yaw  axes.  A block  diagram 
of  a single  channel  in  the  roll  axis  (channel  3)  is  shown  in  figure  6 . Except  for 
scaling,  trim  rate,  and  the  gearing  change  with  wing  position  , the  network  for  the 
pitch  axis  was  basically  the  same . The  yaw  axis  differed  in  scaling  and  trim  rate , 
and  a limiter  was  added  just  after  the  voter . The  voter  output  drove  only  one 
actuator  network. 

Figure  6 shows  one  electrical  comparator  across  the  voter  and  a single  compara- 
-tor  across  each  backup  valve.  In  total,  there  were  eight  comparators  per  backup 
control  electronics  box . The  trip  level  of  the  electrical  comparators  was  set  at 
3 . 0 volts , which  was  approximately  one-third  the  maximum  voltage  for  each  axis . 
This  corresponds  to  a stick  displacement  of  approximately  2 . 5 centimeters  for  roll 
and  5 centimeters  for  pitch.  The  differential  pressure  eomparators  were  set  to  trip 
at  2.4  volts,  which  represents  a differential  pressure  error  of  8273  kN/m* . 

Primary  control  electronics.  — The  primary  control  system  electronics  box  con- 
tained the  signal  interface  between  the  computer's  digital-to-analog  converter  outputs 
and  each  secondary  actuator  for  the  airplane's  pitch , roll , and  yaw  axes . A simpli- 
fied block  diagram  of  a typical  primary  signal  circuit  is  shown  in  figure  7 . For  each 
control  axis , there  were  two  identical  signal  paths , -the  active  and  monitor  channels , 
from  the  computer  to  the  control  valves  of  the  respective  secondary  actuator . The 
primary  control  electronics  box  contained  two  5-hertz  second-order  smoothing 
filters  in  each  of  the  three  axes.  Follow-up  signals  from  the  secondary  actuator 
were  biased  with  the  wing  position  voltage  for  the  pitch  and  roll  actuators . The 
signal  was  then  divided  for  summing  and  sent  directly  to  the  monitor  servo  amplifier 
or  quadruplex  voter  and  processed  with  the  three  comparable  signals  from  the  back- 
up control  system  . In  conjunction  with  the  hydrologic  comparator  , this  provided 
hard-over  protection  from  open  servo  follow-up  signals . 

The  primary  control  electronics  box  also  contained  engage  logic,  monitoring, 
and  the  dc  power  supply  for  the  box  and  the  primary  secondary  actuators . A 
separate  return  comparator  was  used  to  monitor  the  difference  between  comparable 
points  in  each  axis  of  the  primary  and  backup  control  systems . When  the  error  was 
greater  than  3°,  4°,  and  3°  for  the  elevator,  aileron,  and  rudder,  respectively,  the 
primary  control  system  could  not  be  engaged . However , the  backup  control  system 
could  always  be  selected . 

Side  Stick  electronics . — The  installation  of  a side  stick  required  additional 
electronics  that  could  not  be  readily  added  to  the  backup  control  electronics  boxes . 
Therefore , the  additional  electronic  networks  needed  to  provide  demodulation , 
deadband , shaping , and  gradient  (fig . 8)  were  mechanized  to  interface  between  the 
side  stick  transducer  and  the  backup  control  electronics  boxes . The  triplex  elec- 
tronics concept  was  maintained  from  sensor  output  to  the  appropriate  channel  sum 
points  in  the  backup  control  electronics  boxes. 


Secondary  Actuators 

The  secondary  actuator  (fig . 9)  was  a four-channel  electrohydraulic  actuator 
designed  to  convert  electrical  signals  to  surface  motion  and  to  have  two-fail-operate 
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capability . There  were  five  secondary  actuators;  two  for  roll , two  for  pitch , and 
one  for  yaw . The  mechanization  of  the  secondary  actuator  was  an  active /standby 
configuration  which  consisted  of  two  valves  in  the  active  configuration  and  three 
valves  in  the  standby  configuration  . The  secondary  actuator  was  designed  to  be 
controlled  by  any  of  the  four  electrohydraulic  control  channels . Each  primary 
channel  commanded  one  active  valve  to  position  the  actuator;  the  second  valve,  in 
conjunction  with  the  hydrologic  failure  detection  network,  was  used  for  self- 
monitoring. The  actuator  standby  or  backup  channels  commanded  by  the  backup 
control  system  consisted  of  three  force-summed  channels  with  electronic  failure 
detection . 

Two-stage  flapper  nozzle  servovalves  were  used  for  the  primary  system  active 
and  monitor  valves.  During  normal  operation,  these  valves  received  separate 
commands , and  the  active  valve  positioned  the  actuator  ram  as  required . The  fail- 
ure detection  for  the  primary  control  system  was  provided  by  a hydraulic  comparator 
network . A comparator  spool  was  balanced  between  the  force  exerted  by  two 
springs  and  the  output  pressures  from  the  active  and  monitor  spools.  If  a pressure 
difference  beyond  a predetermined  threshold  existed , motion  of  the  comparator 
spool  dumped  the  supply  pressure  to  the  return  line , which  caused  the  primary 
engage  valve  to  reposition  and  block  the  commands  from  the  active  servovalve . 

Errors  that  could  cause  the  hydrologic  comparator  to  trip  were  measured  in  terms  of 
either  single  control  surface  deflection  or  commanded  current.  These  were  4°,  4°, 
and  1.50  for  the  elevator,  aileron,  and  rudder  control  surfaces,  respectively,  or 
one-half  the  maximum  valve  current . 

A dual  pressure  switch  was  installed  in  the  primary  h^ydraulic  circuit  of  each 
secondary  actuator  to  sense  minimum  pressure . The  switch  caused  the  primary  servo 
system  to  disengage  at  4137  kN/m^ , and  a pressure  of  at  least  5516  kN/m^  was  re- 
quired for  manual  reengagement.  When  the  primary  channel  tripped,  the  pressure 
switch  opened , which  caused  the  engage  logic  to  automatically  energize  the  three 
solenoids  in  the  backup  control  system  and  to  transfer  control  to  the  three  single- 
stage  jet  pipe  servovalves  (servo  systems  2,  3,  and  4) . 

The  backup  system  servos  were  monitored  by  differential  pressure  transducers 
that  were  installed  across  the  output  legs  of  each  jet  pipe  servovalve . Each  differen- 
tial pressure  signal  was  compared  with  the  other  two  differential  pressure  signals 
for  each  actuator.  The  comparison  was  made  in  the  backup  control  electronics  boxes. 

The  secondary  actuators  were  modular  in  construction  and  were  designed  around 
three  tandem  pistons  on  a common  shaft . The  primary  channel  and  one  backup  con- 
trol system  channel  shared  one  of  the  piston  networks , and  the  remaining  pistons 
were  controlled  by  the  other  two  backup  systems . Each  secondary  actuator  was 
supplied  by  two  separate  hydraulic  systems.  Figure  9 shows  the  secondary  actuator 
mechanization  in  the  primary  configuration  . 

The  figure  shows  that  the  valve  outputs  of  backup  channels  2 and  4 were  blocked 
by  separate  hydraulic  engage  valves  and  that  the  cylinders  bypassed  fluid  as  the  ram 
moved.  Backup  channel  3 was  blocked  by  an  engage  valve  with  a slightly  different 
design. 

The  servo  position  loop  was  closed  electrically  for  each  channel  in  the  elec- 
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tronics  boxes.  The  electrical  signal  utilized  for  the  servo  ram  position  came  from 
the  quadruplex  redundant  LVDT  in  each  servo  actuator  shaft . The  stroke  of  all  the 
secondary  actuators  was  5 centimeters,  and  by  utilizing  the  necessary  mechanical 
linkage  > the  desired  control  surface  rotation  was  obtained  for  all  five  surfaces . 

Response  characteristics . — Ground  test  data  were  taken  for  each  actuator  with 
different  valve  combinations.  The  performance  of  each  secondary  actuator  was  a 
function  of  the  engaged  servovalves . The  primary  valves  had  much  higher  re- 
sponse than  the  valves  used  in  the  backup  servo  systems  (systems  2 , 3 , 4) , but 
because  of  hardware  problems  (ref.  2)  the  primary  servo  amplifier  gain  was 
lowered . 

A typical  frequency  response  curve  of  the  elevator  secondary  actuator  with  the 
primary  servovalve  in  control  is  shown  in  figure  10 . The  figure  compares  the  flight 
tested  servo  amplifier  gain  , 5 milliamperes  per  volt  , with  the  designed  servo  ampli- 
fier gain  of  22  milliamperes  per  volt . Even  though  the  pitch  servo  bandwidth  flight  , 
tested  was  6 hertz , the  addition  of  a second-order  filter  reduced  the  effective  servo  ' 
bandwidth  to  2.5  hertz.  The  total  bandwidth  of  the  filter,  secondary  actuator,  and 
elevator  power  actuator  was  1.5  hertz  for  an  elevator  surface  amplitude  of  1°  peak 
to  peak,  normalized  at  0.5  hertz. 

The  frequency  response  of  the  same  pitch  secondary  actuator  when  controlled  by 
the  backup  control  system  valves  is  shown  in  figure  11 . Data  are  compared  for  two 
valve  drive  configurations . One  data  set  was  obtained  with  a single  backup  control 
system  channel  valve  in  control  of  the  secondary  actuator . The  other  data  set  was 
obtained  with  all  three  backup  valves  in  control . The  single  backup  control  system 
channel  bandwidth  was  7 hertz , and  the  bandwidth  of  the  three  backup  control  sys- 
tem channels  was  13  hertz . All  three  backup  control  system  channels  per  airplane 
control  axis  had  the  same  servo  loop  gain , which  indicates  that  the  performance  in- 
crease was  a result  of  the  force  summing  of  the  secondary  actuator  pistons . 

Hysteresis.  — Hysteresis  measurements  were  also  taken  for  each  secondary  ac- 
tuator for  the  various  valve  drive  combinations . The  data  were  obtained  by  driving 
the  appropriate  servovalves  with  a signal  generator  set  at  0.01  hertz.  For  example, 
the  hysteresis  of  the  elevator  secondary  actuator  for  the  primary  channel  (fig.  10) 
was  0.44°.  By  increasing  the  loop  gain,  this  value  could  be  reduced  to  0.13°.  The 
equivalent  measurements  for  the  two  backup  control  system  conditions  presented  in 
figure  11  are  1.10°  for  the  single-channel  drive  configuration  and  0.47°  for  the 
three-channel  drive  configuration . 

A minor  item  of  interest  pertaining  to  the  secondary  actuators  was  observed  dur- 
ing single  channel  operation  with  the  backup  control  system . Even  though  the  elec- 
trical commeuids  to  each  paired  surface , such  as  the  aileron  and  elevator , were  the 
same , the  control  surfaces  did  not  track  each  other  during  large  control  cycles . 

This  was  caused  by  the  component  offset  characteristics  in  the  servo  loop  as  well  as 
by  the  seal  friction  of  the  respective  actuator  channel . A given  servo  system  took 
more  current  to  retract  the  ram  for  the  left  control  surface  than  the  right  control 
surface  and  less  current  to  extend  the  left  than  the  right . From  outside  the  airplane 
the  control  surfaces  did  not  appear  to  track . This  was  most  noticeable  with  the  ele- 
vator surfaces . This  condition  existed  with  every  actuator , and  there  was  no  way  to 
adjust  the  offset.  When  additional  servo  systems  were  engaged,  the  condition  was 
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minimized  and  the  agreement  between  the  deflections  of  the  paired  surfaces  was  good . 

The  condition  was  not  apparent  with  the  primary  control  system  engaged 
because  of  the  higher  bandwidth  servovalve  and  pressure  gain. 


Electrical  Power 

The  electrical  power  for  the  operation  of  the  F-8C  aircraft  was  supplied  by  the 
main  generator  power  package . This  unit  was  comprised  of  ac  and  dc  brushless  ' 
generators  that  were  mounted  on  a common  shaft,  regulators  for  the  generators,  ah 
air  turbine  motor  , and  the  necessary  reduction  gears.  Energy  for  the  turbine  was 
supplied  by  high  pressure  bleed  air  from  the  engine.  The  ac  generator  was  rated  at 
12  kilovolt  amperes  at  115  volts  and  400  hertz.  The  dc  capacity  was  68  amperes  at 
30  volts . An  emergency  power  package  supplied  backup  electrical  power  as  well  as 
a hydraulic  pump  driven  from  a ram  air  turbine . The  capacity  of  this  unit  was 
30  amperes  of  dc  and  4.2  kilovolt  amperes  of  400-hertz  power.  Figure  12  shows  the 
power  distribution  system  of  the  F-8  digital  fly-by -wire  airplane  . 

The  power  requirements  of  the  fly-by-wire  system  were  determined  by  the  char- 
acteristics of  the  Apollo  equipment.  This  equipment  limited  the  ripple,  spike,  and 
surge  voltages  on  the  nominal  28-volt  bus  to  a maximum  of  32.5  volts  and  a minimum 
of  24 . 5 volts , with  a peak  current  demand  of  60  amperes . These  requirements , in 
addition  to  a requirement  for  an  estimated  30  amperes  for  the  backup  control  system , 
made  it  necessary  to  install  an  additional  power  source  in  the  airplane.  Therefore, 
a direct-drive,  100-ampere,  32-volt  dc  flight  control  system  generator  was  mounted 
in  the  nose  cone  of  the  engine . The  voltage  regulator  was  set  to  provide  28-volt 
power  at  the  primary  (number  1)  bus.  To  give  the  additional  protection  required  by 
the  Apollo  equipment,  zener  diodes  and  a 55 , 000-microfarad  capacitor  were  placed 
on  the  number  1 bus.  Flight  control  system  power  was  controlled  from  the  cockpit 
through  normally  closed  power  relay  contacts.  A warning  indicator  informed  the 
pilot  of  loss  of  generator  power . 

To  provide  the  necessary  redundancy , 28-volt  power  was  divided  into  four  sep- 
arate busses  by  isolation  diodes  and  circuit  breakers  (fig.  12)  . Each  bus,  one  for  the 
primary  system  and  one  each  for  the  triply  redundant  backup  control  system,  had  a 
24-volt  , 11-ampere-hour  nickel  cadmium  battery  as  an  alternate  source  of  power  . 
Backup  control  system  batteries  were  always  on  the  line , and  they  were  kept  fully 
charged  by  a constant  trickle  charge.  They  could  provide  power  for  a minimum  of 
1 hour  after  the  loss  of  the  flight  control  system  generator . For  additional  protection , 
it  was  made  possible  for  the  pilot  to  place  the  main  dc  generator  on  the  backup  control 
system  busses  with  normal  loads  reduced . To  assist  the  pilot  in  monitoring  the  con- 
dition of  the  backup  control  system  battery , a battery  capacity  meter  was  installed  in 
the  cockpit.  This  device  measured  current  flowing  into  or  out  of  the  battery  in 
terms  of  percent  of  full  charge . It  was  not  intended  for  the  number  1 battery  to 
supply  the  primary  system  with  power  for  more  than  a few  minutes . Its  sole  purpose 
was  to  aid  in  the  stabilization  of  the  bus  voltage  and  to  allow  operation  during  tem- 
porary power  interrupts  like  those  that  occurred  during  bus  switching.  For  the  pro- 
tection of  the  number  1 battery  , a circuit  was  installed  to  remove  the  battery  from  the 
bus  whenever  voltage  dropped  below  20  volts. 
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OPERATIONAL  EXPERIENCE 


The  first  operational  experience  with  the  F-8  digital  fly-by-wire  control  system 
was  acquired  during  the  integration  and  checkout  of  control  system  components  in  an 
iron  bird  simulator  (ref.  1) . The  simulator  was  used  to  fine  tune  the  control  sys- 
tem to  give  it  the  necessary  authority,  trim  rates,  servo  loop  gains,  and  comparator 
trip  levels.  Before  the  first  flight,  the  entire  flight  control  system  was  subjected  to 
an  extensive  ground  test  program  that  lasted  7 months . During  this  period , two 
major  hardware  changes  were  made . Because  of  the  nonlinear  characteristics  of  the 
Apollo  hardware  (ref.  2)  unacceptable  noise  was  transmitted  to  the  secondary 
actuators . A second-order  filter  network  was  installed  to  smooth  the  primary  system 
electronics . The  backup  control  system  integrators  were  changed  to  digital  from 
analog  because  of  drift . 


Backup  Control  System  Flight  Evaluation 

Before  the  first  flight,  the  backup  control  system  was  tailored  to  the  primary 
channel  gearing  and  trim  rates  in  each  airplane  axis . The  flight  controllability  of 
the  primary  control  system  and  the  backup  control  isystem  was  evaluated  on  the  sim- 
ulator . Since  the  sole  purpose  of  the  backup  control  system  was  to  provide  an  emer- 
gency return-home  capability  if  the  primary  system  became  inoperative , the  flight 
testing  of  the  backup  system  was  minimal.  The  testing  did  insure  that  the  backup 
system  would  provide  acceptable  controllability,  and  at  least  once  per  flight  the  F-8 
digital  fly-by-wire  control  system  was  downmoded  to  the  backup  control  system  to 
perform  an  inertial  measurement  unit  alinement.  This  was  done  in  level  flight. 

Center  stick.  — The  piloting  tasks  used  to  evaluate  the  backup  control  system 
with  the  center  stick  paralleled  those  used  to  evaluate  the  primary  control  system  in 
the  direct  mode . The  evaluation  maneuvers  included  routine  flying  while  evaluating 
gross  and  fine  control  maneuvers,  formation  flight,  and  gunsight  tracking.  The 
low-speed  evaluations  included  ground  control  approaches . The  first  flight  evalua- 
tion took  place  at  speeds  between  275  and  300  knots  indicated  airspeed  with  routine 
flying  maneuvers . The  pilot  comments  indicated  that  roll  response  was  adequate 
and  pitch  control  was  good  at  these  flight  conditions . The  airplane  also  exhibited 
satisfactory  handling  qualities  and  control  power  in  the  landing  approach . During 
subsequent  flights , the  airplane  seemed  sensitive  in  the  roll  axis , and  in  a more 
demanding  control  task , that  is , formation  flight , the  pilot  indicated  that  airplane 
roll  response  became  too  oscillatory . He  assigned  the  task  a pilot  rating  of  6 on  the 
Cooper-Harper  scale  (ref.  3) . The  lateral  sensitivity  problem  was  reduced  by 
adding  electrical  deadband  to  the  roll  stick  command  signals . The  modification 
yielded  the  roll  gearing  shown  in  figure  4 (b) . Even  though  the  backup  control 
system  roll  gearing  was  approximately  the  same  as  that  in  a conventional  F-8C  air- 
plane , some  pilots  commented  that  the  airplane  rolled  a little  faster  than  they  liked 
for  a given  stick  displacement  at  300  knots  indicated  airspeed.  However,  they  felt 
that  the  roll  response  was  not  overly  sensitive . A viscous  damper  was  added  to  the 
aileron  stick  linkage  to  improve  the  dynamic  stick  characteristics  for  both  the  pri- 
mary and  the  backup  control  systems . 
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For  the  first  eight  flights  of  the  F-8  digital  fly-by -wire  airplane , a linear  trans- 
ducer was  used  in  the  pitch  axis  of  the  backup  control  system . As  flight  speeds 
increased , a longitudinal  sensitivity  problem  was  observed  by  the  pilot  in  both  the 
primary  and  the  backup  control  systems . This  problem  was  solved  by  reducing  the 
slope  of  the  curve  around  zero  but  maintaining  the  previous  control  authority . Be- 
cause of  the  inflexibility  of  the  design  of  the  backup  control  electronics  boxes  , non- 
linear characteristics  were  obtained  by  having  a stick  transducer  manufactured  that 
was  similar  to  the  original  but  gave  the  desired  curve  shape  . The  pitch  modification 
and  appropriate  scaling  change  in  the  backup  control  electronics  boxes  resulted  in 
the  backup  control  system  pitch  gearing  presented  in  figure  4(a) . Subsequent  flight 
evaluations  indicated  that  control  was  satisfactory  in  cruise  as  well  as  in  the  landing 
approach.  In  normal  flight,  the  airplane's  control  characteristics  with  the  backup 
control  system  were  similar  to  those  in  the  primary  control  system's  direct  (unaug- 
mented) mode.  For  maneuvers  that  required  large  changes  in  pitch,  however,  such 
as  gunsight  tracking  during  windup  turns , the  pilots  preferred  the  backup  control 
system  to  the  primary  control  system  because  of  its  smoother  pitch  response  . The 
characteristics  of  the  primary  channel  were  poorer  because  of  stick  quantization 
(ref.  4) , 

The  trim  switches  for  the  backup  control  system  pitch  and  roll  axes  were  on  the 
left  cockpit  console  just  forward  of  the  throttle  control.  During  the  evaluation  of 
the  backup  control  system,  it  became  apparent  that  the  location  of  the  trim  switches 
was  undesirable . One  pilot  rating  was  at  least  one  number  higher  (poorer)  because 
of  the  additional  workload  due  to  this  location . Beginning  with  the  side  stick  evalua- 
tion phase  of  the  flight  testing,  the  backup  trim  was  activated  from  the  conventional 
center  stick  trim  switch. 

Side  Stick.  -^  The  side  stick  was  evaluated  primarily  by  two  pilots  during  six 
flights . Six  other  flights  were  flown  by  four  pilots  who  were  evaluating  other  fea- 
tures of  the  control  system.  Although  the  side  stick  gradients  were  not  optimized, 
the  side  stick  controller  was  considered  to  be  of  interest  in  the  overall  control  sys- 
tem evaluation.  Side  stick  evaluation  tasks  included  formation  flight,  gunsight 
tracking,  mild  aerobatics,  ground  control  approaches,  landing,  and  takeoff.  Since 
takeoff  was  considered  the  most  uncertain  phase  of  flight  , it  was  performed  only 
after  side  stick  control  was  evaluated  in  a high  pilot  gain  task  during  up  and  away 
flight . During  the  12  evaluation  flights , three  takeoffs  and  seven  landings  utilizing 
the  side  stick  controller  were  made . 

The  stick  gradients  selected  for  flight  test  were  based  upon  the  six-degree-of- 
freedom  simulation  results  obtained  with  the  iron  bird  simulator . The  stick-to- 
surface  gradients  were  selectable,  as  shown  in  figures  5(a)  and  5(b) . The  wing- 
down  gradients  selected  by  most  of  the  pilots  were  position  1 in  pitch  and  position  3 
in  roll.  The  roll  gradients  were  not  changed  during  any  of  the  flights,  whereas  a 
slight  change  was  made  in  the  pitch  axis . The  original  transition , or  knee , of  the 
curve  between  the  low  and  high  gradients  was  at  approximately  36  newtons , and 
this  value  was  increased  to  approximately  57  newtons  for  the  last  three  flights . 

All  the  pilots  adapted  easily  to  the  side  stick  controller  in  flight  after  practice 
on  the  simulator . They  all  commented  on  the  sensitivity  of  the  pitch  axis , particu- 
larly in  high  pilot  gain  tasks  like  formation  flight . The  center  stick  was  also  some- 
what sensitive,  but  the  excursions  were  lower  in  amplitude.  Some  of  the  pilots 
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tended  to  fly  both  pitch  and  roll  with  a pulsing  type  of  input . Most  pilots  tended  to 
hold  a nose-up  stick  force  during  the  various  maneuvers.  The  value  they  used  was 
approximately  23  newtons , which  was  outside  the  stick  deadband . One  of  the  six 
pilots  noted  arm  fatigue  after  a flight  in  which  he  evaluated  side  stick  control . Sev- 
eral pilots  rated  the  formation  flight  control  task  3 to  5 . 

As  discussed  in  reference  5 , gunsight  tracking  was  typified  by  good  to  excellent 
control  over  the  lateral-directional  axis  and  continuous  pitch  oscillations  caused  by 
pitch  commands  that  were  too  abrupt . Crosstalk  was  absent  in  the  tracking  task . 

A comparison  between  a side  stick-controlled  and  a center  stiek-controlled  tracking 
run  showed  a higher  frequency  output  from  the  force  side  stick,  indicating  a higher 
pilot  workload . 

The  wing-up  stick  force  gradients  were  evaluated  in  the  power  approach  con- 
figuration for  pitch  out  maneuvers  and  ground  control  approach  patterns . Many  of 
the  approaches  were  flown  in  light  turbulence  , which  seemed  to  have  little  adverse 
effect  on  control.  Pitch  and  roll  control  was  adequate,  and  pilot  ratings  ranged 
from  2 to  4 for  the  landing  approach  task  . 


Synchronization  Performance 

An  important  design  requirement  for  a backup  control  system  is  that  it  track 
the  primary  system  closely  to  minimize  the  switching  transients.  Therefore,  syn- 
chronization networks  were  used  to  keep  the  systems  synchronized . During  every 
flight , the  primary  system  was  downmoded  to  the  backup  control  system  at  least 
once  to  aline  the  inertial  measurement  unit  in  level  flight  . 

Thus , downmoding  to  the  backup  control  system  was  checked  approximately 
40  times.  The  surface  transients  were  always  less  than  1°.  The  transients  observed 
during  these  downmodes  were  caused  primarily  by  the  differences  in  null  between 
the  primary  and  the  three  backup  servovalves  of  each  secondary  actuator . Overall , 
the  system’s  static  performance  was  good  . 

Simulation  studies  on  the  iron  bird  simulator  showed  that  the  synchronization 
network  bandwidth  of  2 .5  hertz  provided  satisfactory  backup  control  system  track- 
ing of  the  primary  system  for  all  except  abrupt  stick  commands . The  simulator 
studies  also  indicated  that  the  synchronization/trim  network  characteristics  could 
produce  a large  out-of-trim  condition  during  a dynamic  downmode  if  stick  or  pedal 
commands  were  being  applied . The  corrective  action  was  to  trim  out  the  stick  or 
pedal  signal  present  at  the  time  of  the  downmode . 


Trim 

The  backup  control  system  was  mechanized  with  a digital  integrator  for  trimming 
the  backup  control  system  and  for  synchronizing  the  backup  control  system  with  the 
engaged  primary  system . Since  the  control  systems  had  to  be  synchronized  over  the 
full  authority  of  the  control  surfaces , the  integrator  had  to  be  scaled  for  full  control 
authority.  This  resulted  in  an  integrator  resolution  of  0.18®,  0.30®,  and  0.20®  for 
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elevator , aileron , and  rudder , respectively . Trimming  a control  surface  became 
a stepping  operation  and  was  not  precise. 


Hydraulics 

The  conventional  F-8C  hydraulic  systems  were  not  changed  except  for  the  addi- 
tion of  the  F-8  digital  fly-by-wire  secondary  actuators . Two  hydraulic  pumps  each 
delivered  a maximum  of  45  liters  per  minute  at  a nominal  pressure  of  20 ,684  kN/m^  . 
This  capacity  was  marginal  during  two  operations.  At  idle  power,  the  hydraulic  " 
flow  was  inadequate  to  support  preflight  self-tests,  A power  setting  of  80  percent 
proved  to  be  satisfactory  and  was  used  for  airplane  ground  checks . The  self -tests 
were  designed  to  operate  in  all  three  axes  or  one  axis  at  a time.  The  latter  proce- 
dure was  used  most  often , although  the  three-axis  tests  were  completed  in  approxi- 
mately 4 minutes , During  landing  at  idle  power , high  control  surface  activity 
caused  the  hydraulic  pressure  to  drop,  which  caused  the  secondary  actuator  pres- 
sure switches  to  downmode  the  F-8  digital  fly-by-wire  system  from  the  primary  to 
the  backup  control  system.  This  occurred  during  two  landing  rollouts , but  no  con- 
trol system  transients  were  observed  by  the  pilot . 


CONTROL  SYSTEM  RELIABILITY 


The  primary  and  backup  control  systems  operated  approximately  2500  hours 
during  the  fly-by-wire  program , including  both  aircraft  and  iron  bird  operation , 
without  any  major  problems . Six  evaluation  pilots  flew  the  F-8  digital  fly-by-wire 
airplane  42  times  for  a total  flight  time  of  58  hours . Because  of  its  length , the  pro- 
gram was  not  expected  to  establish  a level  of  confidence  in  fly-by-wire  control  sys- 
tems , but  it  did  constitute  a first  step  toward  developing  such  confidence.  From 
the  first  flight , the  airplane  was  flown  with  a control  system  that  had  no  mechanical 
backup  or  reversion  capability . During  the  evaluation  flights , there  were  no  sys- 
tem failures  that  could  be  attributed  to  the  fly-by-wire  aspect  of  the  digital  flight 
control  system . There  were  no  electronic  failures  in  flight  in  either  the  digital 
primary  system  or  the  backup  control  system . There  was  one  hydraulic  line  failure 
that  reduced  the  total  system  redundancy  level  from  four  channels  to  two  channels  , 
but  flight  was  no  more  critical  than  it  would  have  been  if  a similar  failure  had 
occurred  in  a standard  F-8G  airplane . This  is  discussed  in  more  detail  below . 

In  addition  to  the  reliability  of  the  total  system , it  is  important  to  discuss  the 
reliability  of  the  elements  of  the  system . Table  1 summarizes  the  discrepancies  that 
occurred  in  the  F-8  digital  fly-by-wire  control  system.  The  table  Includes  the  dis- 
crepancies experienced  with  the  iron  bird  simulator  as  well  as  those  experienced 
with  the  F-8  digital  fly-by-wire  airplane.  Discrepancies  observed  during  ground 
operation,  preflight  testing,  and  in  flight  are  listed  by  major  system  component . A 
discrepancy  was  any  system  operation  that  appeared  to  be  abnormal . Some  were 
minor  transient  effects  that  did  not  affect  the  system's  performance  or  reliability. 
The  number  of  discrepancies  that  required  a repair  or  replacement  action  is  indi- 
cated . Even  if  no  repair  was  required , extensive  tests  were  made  to  insure  that  the 
component  in  question  performed  as  designed . 
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The  discrepancies  listed  for  the  computer  and  related  hardware , which  are  dis- 
cussed in  reference  4 , are  listed  here  to  present  an  overview  of  the  operational 
problems  encountered  during  the  program.  A coolant  system  designed  specifically 
for  the  Apollo  system  used  on  the  F-8  digital  fly-by-wire  airplane  caused  one  flight 
to  be  canceled  before  takeoff  and  one  flight  to  be  terminated  early . The  coolant 
system  problem  was  attributed  to  lines  that  were  frozen  and  did  not  permit  the 
coolant  to  flow  through  the  cold  plates  . When  this  occurred  in  flight,  the  coolant 
system  was  being  monitored  and  the  flight  was  terminated  before  it  affected  the  con- 
trol system . The  pilot  continued  to  fly  on  the  digital  primary  system , and  four 
channel  redundancy  was  retained  through  landing . This  problem  was  unique  to  the 
Apollo  equipment  and  therefore  would  not  be  expected  in  production  fly-by-wire 
systems . 

Three  power  turn-on  problems  were  observed,  two  with  the  backup  electronics 
and  one  with  the  primary  electronics . On  one  occasion , measurements  indicated  that 
the  voltage  supply  for  the  primary  electronics  was  not  present . Recycling  the  power 
switch  brought  the  power  supply  on  line , and  during  subsequent  testing  the  problem 
did  not  reappear , Laboratory  testing  did  not  reveal  the  cause  of  the  problem , but  a 
similar  power  turn-on  indication  was  obtained  by  grounding  either  the  plus  or  minus 
power  supply. 

Six  failures  due  to  open  buffer  resistors  were  recorded  in  the  primary  and  back- 
up electronics  early  in  the  program . It  was  discovered  that  the  resistance  wire  in 
these  resistors  was  affected  by  chemical  or  electrolytic  corrosion . All  the  buffer 
resistors  were  replaced  by  a different  type  of  resistor , and  no  other  problems  of 
this  type  were  encountered.  The  other  component  failures  listed  were  caused  by  an 
intermittently  functioning  capacitor,  a failed  zener  diode,  and  an  open  transistor  . 
None  of  these  occurred  in  flight , and  all  were  detected  through  normal  testing  pro- 
cedures. During  the  flight  program  there  were  12  backup  electronic  comparator 
tripouts , but  the  redundancy  level  of  the  total  system  was  not  affected . Ground 
checkout  indicated  that  there  were  no  failed  components . 

The  secondary  actuator  discrepancies  consisted  of  component  failures , problems 
related  to  differential  pressure , and  differential  pressure  comparator  tripouts . With 
25  servovalves,  20  engage  solenoids,  and  20  differential  pressure  transducers  in  the 
airplane,  occasional  problems  were  expected.  The  servovalve  was  the  only  second- 
ary actuator  component  to  fail . Three  such  failures  occurred  in  the  aircraft  system . 
They  were  detected  during  ground  tests  and  repaired . If  such  a failure  had  occurred 
in  flight  it  would  have  caused  the  loss  of  one  of  the  four  actuator  channels . 

As  the  table  shows , the  largest  number  of  discrepancies  occurred  in  the  second- 
ary actuator  differential  pressure  network . Four  aborted  takeoffs  were  charged 
against  the  differential  pressure  network  , as  well  as  four  in-flight  and  26  preflight 
differential  pressure  comparator  tripouts . Most  of  these  discrepancies  were  classi- 
fied as  nuisance  tripouts  and  occurred  during  control  cycles  whenever  the  primary 
system  was  engaged.  All  comparator  tripouts  were  resettable  by  the  pilot,  and  the 
total  system's  redundancy  was  not  affected.  Generally  speaking,  most  of  the  differ- 
ential pressure  problems  experienced  were  caused  by  a tracking  error  between  the 
various  differential  pressure  signals , which  caused  the  servo  comparators  to  trip . 
This  frequently  occurred  at  the  maximum  travel  of  the  actuator , where  the  differen- 
tial pressure  signals  were  the  highest . These  nuisance  tripouts  were  caused  by  a 
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combination  of  the  various  components’  tolerances  and  valve  nulls,  and  were  pre- 
dictable for  certain  stick  motions . The  problem  could  be  resolved  by  adding  nulling 
capability  to  the  servo  loop  to  balance  the  various  differential  pressure  signals  . 

Another  problem  associated  with  the  differential  pressure  monitoring  system 
was  the  inability  to  detect  some  of  the  open  failures . Unless  the  ram  was  stationary , 
it  was  difficult  to  develop  the  differential  pressure  necessary  to  disengage  the 
faulty  servo  channel . As  a result , a latent  channel  failure  could  occur  in  flight  in 
the  backup  control  system  and  not  be  indicated  to  the  pilot . However , no  such  fail- 
ures occurred  during  the  program , 

Six  discrepancies  were  attributed  to  system  wiring  and  aircraft  power  distri- 
bution. Four  involved,  respectively , a pin  that  was  pushed  back  in  a connector, 
a short-circuited  cable  clamp , a defective  latching  relay , and  a faulty  battery  capac- 
ity meter . The  faulty  items  were  identified  and  repaired  during  the  regular  air- 
plane preflight . Two  flights  were  aborted  because  of  aircraft  power  problems . One 
was  due  to  a checklist  error  that  allowed  the  flight  control  system  generator  to  re- 
main off,  causing  a low -voltage  shutdown  of  the  computer,  and  the  other  was  due  to 
a main  generator  failure.  All  those  discrepancies  were  considered  to  be  typical  air- 
plane operating  problems  and  not  unique  to  fly-by-wire  control  systems . 

Four  discrepancies  that  affected  or  would  have  affected  the  digital  fly-by-wire 
system  occurred  in  the  aircraft  hydraulics  systems,  and  all  required  repair  action. 
Hydraulic  leaks  that  caused  two  flights  to  be  cancelled  were  detected  in  the  second- 
ary actuators.  During  one  flight,  hydraulic  oil  was  seen  streaming  along  the  out- 
side of  the  airplane , and  as  a precautionary  measure  the  flight  was  terminated  and 
the  airplane  returned  for  a normal  landing.  During  another  flight,  a hydraulic  line 
ruptured , causing  a loss  of  hydraulic  pressure  to  backup  channels  2 and  4 . The 
hydraulic  line  was  part  of  the  basic  F-8C  hydraulic  system  that  was  not  modified  for 
the  program . The  loss  of  hydraulic  pressure  was  detected  by  the  pilot  from  the 
conventional  F-8C  hydraulic  pressure  gages  and  warning  lights . The  pilot  terminated 
the  flight  and  landed  the  airplane  with  the  primary  control  system . Hydraulic  line 
failures  are  rare  but  serious  for  flight  control  systems  that  depend  on  irreversible 
hydraulic  actuators  , such  as  those  being  used  in  all  high-performance  fighter  and 
bomber  aircraft  and  many  new  transport  aircraft . Protection  against  hydraulic 
system  failure  is  provided  by  using  dual  or  triple  hydraulic  systems . Experience 
with  aircraft  that  use  irreversible  actuators  has  shown  the  protection  provided  by 
this  practice  to  be  adequate. 

As  the  table  shows , similar  operating  problems  were  experienced  with  the  iron 
bird  control  system.  All  the  simulation  systems  were  flight  qualified  and  could  be 
flown  on  the  airplane  except  the  mechanizations  of  the  primary  and  backup  elec- 
tronics, which  were  not  maintained  with  flight  system  quality  control.  The  experi- 
ence obtained  during  the  almost  2500  hours  of  operating  time  on  the  iron  bird  and 
the  F-8  digital  fly-by-wire  airplane  is  indicative  of  what  could  be  expected  of  a 
similar  period  on  the  aircraft  system . 

Although  many  component  discrepancies  occurred  during  the  program  , they 
were  detected  by  the  monitoring  system  and  testing  procedures,  and  the  reliability 
of  the  total  system  was  maintained  throughout  the  program . 
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CONCLUDING  REMARKS 


A digital  fly -by -wire  control  system  with  a triplex  analog  backup  control  sys- 
tem was  flight  tested  in  an  F-8C  airplane.  Six  pilots  logged  58  flight  hours  during 
42  flights.  The  backup  control  system  operated  well  in  conjunction  with  the  digital 
primary  system  and  provided  satisfactory  handling  qualities  throughout  the  flight 
envelope  evaluated . This  experience  showed  that  a dissimilar  control  system  can 
be  made  to  synchronize  with  the  primary  flight  control  system  and  provide  satis- 
factory control  during  normal  flight  maneuvers  , 

A limited  flight  test  program  was  flown  to  evaluate  airplane  handling  qualities 
with  a force  side  stick  controller  through  the  backup  control  system . Even  though 
side  stick  force  gradients  were  not  optimized , the  control  of  the  airplane  in  a variety 
of  control  tasks,  including  takeoff,  landing,  and  formation  flight,  was  satisfactory. 

The  operational  reliability  of  the  digital  fly -by-wire  system,  both  primary  and 
backup,  was  excellent.  There  were  no  downmodes  from  the  digital  primary  con- 
trol system  to  the  backup  control  system  in  flight  due  to  real  or  apparent  system 
failures.  Several  component  discrepancies  occurred  within  the  redundant  system, 
but  they  did  not  affect  the  reliability  of  the  total  system . Most  of  the  discrepancies 
were  in  the  secondary  actuator  differential  pressure  network  and  were  nuisance 
tripouts  (capable  of  being  reset)  within  the  backup  control  system  during  large 
control  inputs  to  the  digital  primary  control  system . 
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TABLE  1.-  F-8  DIGITAL  FLY-BY-WIRE  CONTROL  SYSTEM  DISCREPANCIES 
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Figure  1 . F~8  digital  fly-by-wire  control  system . 
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Test  results  To  computer  test  stimuli 

from  computers  and  disable  switches 


Figure  2 . Self-test  unit . 


Figure  3.  Components  of  F-8  digital  fly -by-wire  control  system . 
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(a)  Pitch. 


Figure  4.  Comparison  of  conventional  F-8C  and  F-8  digital  fly-by-wire 
backup  control  system  pitch,  roll*  and  yaw  axis  gearing. 


Conventional  F-8C 

F“8  digital  fly-by-wIre  backup  control  system  - wing  down 
F-8  digital  fly-by-wIre  backup  control  system  - wing  up 
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Side  stick  electronics 
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Figure  8 . Side  stick  block  diagram . 
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Primary  system  Backup  system  2 


Figure  9 . Hydraulics  of  secondary  actuator  with  primary  channel 
in  control  and  channels  2,3,  and  4 in  standby  configuration . 
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Figure  11 . Comparison  of  elevator  secondary  actuator  frequency 
response  controlled  with  backup  control  system  valves . 
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Turbine 


Figure  12 . Simplified  diagram  of  F-8  DFBW  power  distribution  system . 
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MAN-RATED  FLIGHT  SOFTWARE  FOR  THE  F-8  DFBW  PROGRAM 


Robert  R . Bairnsfather 

The  Charles  Stark  Draper  Laboratory , Incorporated 

SUMMARY 


The  design,  implementation,  and  verification  of  the  flight  control  soft- 
ware used  in  the  F-8  DFBW  program  are  discussed.  Since  the  DFBW  utilizes  an 
Apollo  computer  and  hardware,  the  procedures,  controls,  and  basic  management 
techniques  employed  are  based  on  those  developed  for  the  Apollo  software  sys- 
tem. Program  Assembly  Control,  simulator  configuration  control,  erasable- 
memory  load  generation,  change  procedures  and  anomaly  reporting  are  discussed. 
The  primary  verification  toolS' — the  all-digital  simulator,  the  hybrid  simula- 
tor, and  the  Iron  Bird  simulator— are  described,  as  well  as  the  program  test 
plans  and  their  implementation  on  the  various  simulators.  Failure-effects 
analysis  and  the  creation  of  special  failure-generating  software  for  testing 
purposes  are  described.  The  quality  of  the  end  product  is  evidenced  by  the  F-8 
DFBW  flight  test  program  in  which  42  flights,  totaling  58  hours  of  flight  time, 
were  successfully  made  without  any  DFCS  inflight  software,  or  hardware,  fail- 
ures or  surprises. 


INTRODUCTION 


From  early  1971,  CSDL  participated  in  Phase  1 of  the  Digital  Fly-by-Wlre 
program  being  administered  by  NASA  Flight  Research  Center  (NASA/FRC) . Overall 
program  effort  was  directed  toward  a series  of  demonstration  Fly-by-Wire  (FBW) 
aircraft  flights.  A triply  redundant  Analog  Fly-by-Wlre  (AFBW)  Backup  Control 
System  (BCS),  employing  a simple  open-loop  control  algorithm,  is  coupled  with 
the  primary  flight  control  system  to  provide  the  two-fall-operate/f ail-safe 
reliability  necessary  for  severing  mechanical  linkages.  The  simplex  Digital 
Fly-by-Wire  (DFBW)  Primary  Control  System  (PCS)  has  both  software  and  hardware 
failure-detection  capability  in  the  digital  computer.  There  are  also  indepen- 
dent monitoring  and  failure-detection  modules  operating  on  PCS  control  com- 
mands, power  supplies,  pilot  input  devices,  and  other  critical  areas.  Finally, 
there  is  the  capability  for  pilot-initiated  downmoding  to  BCS  via  several  inde- 
pendent paths.  There  are  seven  selectable  PCS  flight  control  modes  available. 
Three  Direct  (DIR)  modes  consist  of  pilot  stick/pedal  plus  trim  applied  directly 
to  the  control  surfaces.  Three  Stability  Augmented  System  (SAS)  modes  incor- 
porate body-axis  angular  rates  (and  lateral  acceleration)  as  feedback  variables. 
The  Command  Augmented  System  (CAS)  mode  is  basically  pitch  SAS  with  normal 
acceleration  feedback  and  forward- loop  integral  bypass.  The  only  BCS  mode. 
Direct,  is  also  selectable  by  axis. 
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The  first  Fly-by-Wlr^  flight  was  made  on  25  May  1972,  in  the  high  per- 
formance F-8C  fighter  assi^ed  to  the  DFBW  program.  Takeoff  and  landing  were 
made  in  PCS/DIR.  Basic  performance  and  handling  qualities  were  demonstrated 
at  several  flight  conditions,  both  in  BCS  and  PCS/DIR.  Closed-loop  PGS/SAS  was 
first  flown  on  18  August  1972  with  subsequent  flights  building  toward  full  sys- 
tem capability.  The  demonstration  flight  test  program  continued  through  late 
1973. 


The  CSDL  role  in  the  F-8  DFBW  program  has  been  directed  at  the  PCS  sof  t- 
ware, hardware,  and  peripherals.  Specific  tasks  have  been;  the  hardware  de- 
sign, development,  and  testing  of  the  uplink  and  downlink  converters,  the  PIPA 
Simulator,  and  the  Gimbal  Angle  Simulator;  and  software  design,  implementation, 
and  verification  of  the  NASA/FRC  three-axis  Primary  Control  System  algorithms; 
the  functional  design,  software  design,  production,  and  verification  of  the 
mode  and  gain  change  routines,  miscellaneous  ground  test  programs,  and  open- 
loop  inflight  earth-rate  torquing  routine;  the  interface  design  including 
failure  analysis;  simulation  support;  the  review  and  verification  of  preflight 
erasable  loads. 


The  R-8  DFBW  System 

Aircraft- — The  F-8C  Crusader,  a carrier-based  U,S, Navy  fighter  of  mid-50's 
vintage,  is  a high-performance  single-seat  aircraft  capable  of  Mach  1.8  flight 
at  altitudes  of  60,000  feet.  NASA/FRC  obtained  several  surplus  aircraft  of  the 
F-8  series.  Two  of  them  are  involved  in  the  F-8  DFBW  program,  one  as  the  flight 
article  and  one  as  the  Iron  Bird  Simulator  test  article.  Figure  1 depicts  the 
F-8C  aircraft,  showing  the  physical  distribution  of  key  F-8  DFBW  hardware.  De- 
scriptions of  the  hardware  are  given  in  Table  1 and  Table  2. 

Digital  System — The  digital  Computer  used  by  the  PCS  is  the  general  pur- 
pose Apollo/LM  Guidance  Computer  (LGC) . An  Apollo  Inertial  Measurement  Unit 
(IMU)  provides  attitude  angles,  angular  rates,  and  linear  accelerations  for 
feedback  control.  Major  considerations  for  using  the  Apollo  hardware  were  that 
it  possessed  a demonstrated  reliability  and  flexibility.  Moreover,  surplus  LM 
hardware  was  available  from  cancelled  Apollo  missions.  Experienced  teams  of 
software  and  hardware  specialists  were  also  available,  for  software  and  systems 
integration  tasks,  at  CSDL  and  Delco  Electronics.  A functioning  Operating  Sys- 
tem software  existed  for  the  LGC,  in  addition  to  the  supporting  facilities  of 
the  powerful  Assembler  software,  the  All-Digital  Simulator,  and  two  hardware- 
integrated  simulators  at  CSDL.  Starting  with  this  framework  meant  that  a sign! 
ficant  portion  of  the  development  task  was  already  completed.  There  were  some 
disadvantages,  the  most  significant  being  the  July  1972  scheduled  shutdown  of 
the  core-rope  manufacturing  facilities  for  the  LGC  fixed  memory.  Another  dis- 
advantage, although  not  recognized  immediately,  was  that  the  F-8C  performance 
envelope  exceeded  the  design  capabilities  of  some  Apollo  hardware  items.  This 
influenced  the  digital  flight  control  system  (DFCS)  performance,  and  required 
a reduced  perfomance  envelope,  which,  while  less  than  F-8C  capabilities,  was 
nevertheless  acceptable  for  an  experimental  digital  fly-by-wire  testbed. 


166 


Computer- — The  LGC  contains  two  distinct  memories,  fixed  and  erasable,  as 
well  as  hardware  logic  circuits.  The  fixed  memory  is  stored  in  a wire  braid 
which  is  manufactured  and  installed  in  the  computer . This  memory  cannot  be 
changed  after  manufacture  and  it  can  only  be  read  by  the  computer.  Fixed  memory 
contains  36,864  words  of  memory  grouped  into  36  banks.  Each  word  contains  15 
bits  of  information,  plus  a parity  bit.  The  erasable  memory  makes  use  of  fer- 
rite cores  which  can  be  both  read  and  changed.  It  consists  of  2048  words 
divided  into  8 banks.  Erasable  memory  is  used  to  store  such  data  as  may  change 
up  to  or  during  a mission,  and  is  also  used  for  temporary  storage  by  the  pro- 
grams operating  in  the  computer.  The  memory  cycle  time  (MCT)  in  the  LGC  is 
11.7  ps.  Most  single-precision  instructions  are  completed  in  two  MCTs;  most 
double-precision  machine  instructions  are  completed  in  three  MCTs. 


SOFTWARE  DEVELOPMENT 


The  software  control  procedures  employed  for  F-8  DFBW  selectively  follow 
those  developed  and  successfully  applied  during  the  generation  of  software  pro- 
gram assemblies  for  the  Apollo  command  and  lunar  module  computers,  A continua- 
tion of  useful  procedures,  made  necessary  because  the  F-8C  uses  the  same  Apollo 
hardware,  and  desirable  because  of  schedule  limitations,  was  easily  imposed  by 
the  CSDL  personnel  connected  with  F-8,  all  of  whom  were  contributors  to  the 
Apollo  effort.  The  limited  scope  of  F-8  dictated  some  changes  in  procedure,  but 
these  were  basically  simplifications  commensurate  with  the  level  of  effort. 
After  all,  approximately  400  man-months /month  were  expended  in  Apollo  by  CSDL 
programming  and  engineering  groups  just  prior  to  the  first  lunar  landing,  while 
F-8  DFBW  peaked  at  about  9 man-months /month.  The  critical  time  span  was  from 
Control  Law  Specification  delivery  in  March  of  1971  until  program  release  for 
fixed-memory  core-rope  manufacture  in  mid-December  of  1971.  Since  that  date, 
CSDL  has  supported  Preflight  Erasable  Load  generation,  failure  analysis,  pre- 
flight procedure  preparation,  and  Erasable  Memory  Program  development  and 
verification.  The  timely  development  and  excellent  flight-test  performance  of 
DFBW  software  attest  to  the  effectiveness  of  the  control  procedures  employed. 

It  is  worth  emphasizing  that  we  now  have  more  modern  software  techniques,  but 
that  Phase  1 of  F-8  DFBW  was  a basic  evaluation  program,  and  utilized  off-the- 
shelf  software  as  well  as  hardware.  Approximately  85  man-months  and  95  hours 
of  IBM  360/74  computer  time  were  required  for  the  Phase  1 software  design, 
implementation,  and  verification  tasks.  The  F-8  chronology  is  shown  in  Fig.  2. 


Operational  Software 

The  operational  software  for  F-8  DFBW  consists  of  two  basic  categories  : 
the  DFCS  Program  Assembly,  and  the  Preflight  Erasable  Load  Assembly.  In  the 
finished  product,  the  DFCS  Program  Assembly  is  embodied  in  the  core  rope  and 
comprises  the  computer's  fixed  memory.  At  this  stage,  it  has  become  hardware 
and  is  effectively  a breadboard  autopilot  in  that  the  structure  is  invariant 
while  most  parameter  values  and  switch  words  are  variable.  For  F-8  DFBW,  there 
is  only  one  final  Program  Assembly,  from  which  the  flight  rope  and  an  identical 
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spare  are  manufactured.  The  Preflight  Erasable  Load  Assembly  is  embodied  in  a 
tape  and  comprises  the  computer's  Initial  Data  Load.  The  tape,  KSTAE.T,  con- 
tains parameter  values  and  switch  settings  required  by  the  program,  and  the 
computer  receives  it  as  a part  of  each  power-up  sequence.  A new  Preflight 
Erasable  Load  Assembly  is  made  whenever  a flight  test  requires  new  parameter 
values.  To  ensure  the  high  degree  of  reliability  and  safety  that  is  necessary 
for  man-rated  flight  software,  both  assembly  processes  are  carefully  controlled. 


Program  Assembly 

The  Program  Assembly  has  two  main  functional  areas:  Systems  and  Appli-- 

cations.  Grouped  under  Systems  are  Executive,  Restart,  and  Service.  Applica- 
tions covers  Flight  Control,  and  Miscellaneous.  The  Executive  code  includes 
the  priority  job-queue  processor,  the  time  task-queue  processor,  the  time- 
dependent  interrupt  processor,  the  idle-job  routine.  The  Restart  code  includes 
the  hardware  restart  interrupt  processor,  computer  initialization  routine,  the 
program  alarm  processor,  the  restart-group  phase-control  routines.  The  Ser- 
vice code  includes  the  list-processing  interpreter,  the  IMU  monitor,  the  com- 
puter self- test  routines,  the  man-machine  interface  routines,  the  interrupt 
processors.  The  Flight  Control  code  includes  the  autopilot  initialization 
routine,  the  mainline  proeessor,  the  filter  pushdown  and  wrap-up  processor, 
the  input  discrete  processor,  the  Mode  and  Gain  change  processor,  the  body 
transformation  matrix  processor.  The  miscellaneous  code  includes  the  ground 
test  programs,  and  special-purpose  applications  routines. 

In  several  areas,  the  flight  control  requirements  and  the  LGC  character- 
istics posed  interesting  problems.  Some  of  these  are  singled  out. 

Duty  Cyle — ^Early  in  the  development  process  it  became  clear  that  the 
Flight  Control  system  would  create  a relatively  high  duty  cycle  in  the  LGC  due 
to  several  causes:  LGC  instruction  time  (24  ys/instr),  the  flight  control 

sample  period  (30  ms)  and  the  generalized  nature  of  the  control  system.  Since 
the  entire  LGC  is  devoted  to  the  DFCS,  words  of  code  could  be  traded  for  in- 
creased time  efficiency  wherever  possible;  that  is,  code  is  designed  for 
minimum  execution  time  rather  than  for  minimum  storage.  Time  savings  are  also 
realized  for  control  parameters,  where  combinable  multiple  parameters  are  re- 
placed by  an  equivalent  single  parameter  in  a working  register,  whose  value  is 
generated  only  once  by  program  initialization. 

Restart  Protection — A hardware  restart  is  a special  interrupt  that  takes 
precedence  over  all  other  interrupts,  and  that  cannot  be  inhibited.  The  hard- 
ware restart  is  triggered  by  circuitry  in  event  of  selected  computer  malfunc- 
tions. On  completion  of  the  restart,  all  output  channel  discretes  are  cleared, 
and  computer  control  is  transferred  to  a specific  memory  location,  i.e.,  to 
the  Restart  Routine.  The  Restart  software  rapidly  reestablishes  the  channel 
output  interfaces  because  F-8C  control  surface  commands  and  the  PCS  primary- 
enable  signals  depend  on  a viable  interface.  The  restart  software  next  restores 
the  program  flow  by  reestablishing  the  job-queue  and  time-queue,  and  by  causing 
the  program  whose  execution  was  interrupted  to  resume  at  the  latest  restart 
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point.  Restart  points  are  entry  points,  breaking  program  flow  into  separate 
blocks,  such  that  a properly  restart-protected  program  will  reproduce  the 
same  values  after  a restart  as  before. 

In  general,  a repetition  of  code  execution  is  involved  following  a re- 
start because  the  nature  of  the  LGC  requires  software  recovery  procedures. 
However,  the  repetition  requires  that  special  care  be  taken  during  code  gen- 
eration to  avoid  creating  situations  where  a restart  will  cause  a multiple 
update  of  a variable.  For  example,  if  the  operation  A+B  -»■  A occurs  between 
two  restart  points,  then  A is  updated  at  each  pass  through  the  code.  This 
violates  the  rule  that  the  values  generated  by  code  repetition  after  a restart 
must  be  the  same  as  before.  The  situation  of  multiple  updates  is  avoided  by 
a copy  cycle,  which  involves  an  intermediate  variable  and  an  additional  restart 
point.  For  the  example  we  have  A+B  ->■  G,  followed  by  the  new  restart  point, 
followed  by  C A.  Clearly,  the  final  value  of  cell  A is  unaffected  by  code 
repetition.  Copy  cycles  are  common  in  Apollo  code  and  have  the  advantage  of 
economy  of  erasable  memory  usage  although  they  are  expensive  in  terms  of  exe- 
cution time.  Note  that  cell  C is  intermediate  and  can  be  used  by  many  copy 
cycles. 

Rather  than  use  copy  cycles,  F-8  DFBW  prefers  a method  that,  because  of 
the  high  DFCS  duty  cycle,  is  conservative  of  time  but  is  expensive  in  fixed 
and  erasable  memory  cells,  doubling  the  number.  Two  functionally  identical 
strings  of  code,  a J-branch  and  a K-branch,  are  required  with  processing  alter- 
nating from  one  to  the  other.  Two  equivalent  sets  of  erasables  are  required, 
also  J-branch  and  R-branch.  The  J-branch  code  uses  K-branch  (past  value) 
outputs  plus  J-branch  (present  value)  inputs  to  compute  J-branch  (present 
value)  outputs.  No  special  copy  cycles  are  required,  and  computations  are 
efficiently  performed.  Copy  cycles  would  likely  have  pushed  DFCS  duty  cycle 
dangerously  close  to  100%.  It  reaches  91%  even  with  time-efficient  restart 
protection. 

Indirect  Transfer — At  sixteen  critical  points  in  F-8  DFBW  program  flow, 
and  at  one  point  in  the  downlink  prograin»  a capability  is  provided  for  erasable 
indirect  transfer  of  control.  In  application  the  program  flow  of  the  hardware 
core-rope  fixed  memory  program  is  determined  by  the  address  contained  in  a 
specific  erasable  cell  at  the  time  the  cell  is  accessed  by  the  program. 

Erasable  cells  used  in  this  manner  fall  into  two  classes.  There  is  the  class 
of  cells  whose  contents  (the  destination  address)  is  changed  regularly  under 
program  control,  say  every  20  ms  or  30  ms.  These  cells,  although  erasable, 
form  an  integral  part  of  the  core-rope.  The  second  class  consists  of  cells 
whose  contents  are  in  general  established  only  once, .either  by  an  initializa- 
tion pass  or  by  the  Initial  Data  Load  (KSTART  tape) . It  is  this  second  class 
of  erasable  cells  that  provides  the  powerful  capability  of  altering  the  program 
flow  after  core- rope  manufacture  by  means  of  Erasable  Memory  Programs. 

Generalized  Filters- — ^^Inasmuch  as  F-8  DFBW  is  a flying  breadboard,  the 
feedback  sensor  quantities  are  each  provided  with  a generalized  filter.  The 
five  filters,  three  for  body  rates  and  two  for  linear  accelerations,  allow 
flexibility  of  filter  choice:  bypass,  first  order,  second  order,  and  third 

order.  An  alternate  third  order  is  obtained  by  cascading  the  first  and  second 
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order  sections  to  obtain  control  over  individual  poles  and  zeros.  The  filter 
coefficients  are  parameters  in  the  KSTART  tape.  The  filters  are  active  at  all 
times,  even  in  BCS/DIR. 

The  computations  are  divided  into  two  phases,  the  main  phase  which  in- 
corporates the  current  input  with  past  values  to  update  the  output,  and  the 
pushdown  or  wrap-up  phase  which  updates  the  other  filter  quantities  in  prepara- 
tion for  the  next  cycle.  In  this  manner  the  control  surface  commands  which 
use  the  filter  outputs  are  generated  with  the  shortest  delay.  The  time- 
consiHtting  filter  wrap-up  calculations  are  not  performed  until  after  closing 
the  aircraft  control  loop,  and  so  do  not  contribute  to  the  delay.  The  saving 
is  significant  because  the  wrap-up  can  represent  as  much  as  92%  of  the  total 
filter  load. 

Gain  Change— Manual  gain  changing  is  provided  in  lieu  of  automatic  gain 
changing  as  a function  of,  say,  dynamic  pressure.  Separate  pitch,  roll,  and 
yaw  gain-select  switches  on  the  MAPP,  each  with  four  positions,  comprise  the 
pilot  interface.  Selection  of  a specific  gain  (or  coefficient)  parameter  is 
made  from  a fixed  list  of  105  candidates,  serially  numbered  from  1 to  105. 

Each  gain  is  associated  (by  axis)  with  a particular  gain-select  switch,  and 
a maximum  of  9 gains  can  be  designated  for  a given  flight.  Each  gain  chosen, 
with  its  serial  number  and  four  values,  becomes  part  of  the  PEL.  When  a gain- 
select  switch  is  changed  by  the  pilot,  the  program  recognizes  the  change  and 
the  PEL-designated  gains  associated  with  that  switch  axis  are  changed.  For 
each  gain  in  turn,  a small  routine  implements  the  change,  performing  all 
necessary  scaling,  recomputing  all  working  registers  using  that  gain,  and 
initializing  any  filter  using  that  gain. 

Erasable  Memory  Programming- — Erasable  memory  programming  provides  the 
only  means  of  modifying  the  program  once  the  core  rope  is  manufactured.  Modi- 
fication can  sometimes  be  accomplished  by  breaking  into  the  program  flow  at  a 
suitable  erasable  branch  point,  which  must  be  of  the  second  class  as  defined 
above.  The  procedure  is  to  change  the  erasable  cell  contents  to  point  to  an 
unused  block  of  erasable  memory  and  to  load  executable  code  into  that  area 
(called  an  Erasable  Memory  Program  or  EMP).  The  final  instruction  of  the  EMP 
returns  control  to  the  fixed  memory  program.  The  EMP  allows  some  unanticipated 
problems  to  be  solved  by  shoehorning  suitable  code  into  the  program  flow. 

Erasable  Downlist— In  Apollo,  the  identification  and  specification  of 
telemetered  data  was  done  by  means  of  address  tables  built  into  the  core  rope. 
For  a mature  design  such  as  Apollo,  quantities  of  interest  are  well  known,  and 
properly  can  be  built  into  the  rope.  F-8  DFBW,  on  the  other  hand,  must  offer 
flexibility  for  experimental  design.  Variables  and  quantities  of  interest  can 
change  from  day  to  day  depending  on  a given  flight  plan.  To  accomplish  this 
end,  erasable  specification  of  the  downlist  quantities  by  means  of  KSTART  tape 
is  incorporated  into  the  Downlink  program. 
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Preflight  Erasable  Load  Assembly 

Plexibility  is  achieved  in  the  F-8  DFBW  despite  the  hardware  status  of  the 
core-rope  program  by  providing  for  a large  number  of  erasable  parameters.  The 
aggregate,  called  the  Preflight  Erasable  Load,  consists  of  three  categories: 

Data  words,  Downlist  Words,  and  Erasable  Memory  Program  words.  The  Data  words 
are  constants  and  include  loop  gains,  filter  coefficients,  nonlinearity  para- 
meters, IMU  compensation  parameters,  branch  control  parameters,  and  branch 
control  address  constants.  The  Downlist  words  are  address  constants  that  de- 
fine the  quantities  to  be  telemetered.  The  EMP  words  are  executable  code  and 
associated  constants. 

Early  in  the  program  the  Preflight  Erasable  Load  and  the  KSTART  tape  con- 
sisted only  of  Data  words  and  Downlist  words,  and  were  generated  by  CSDL.  But 
the  responsibility  for  the  data  values  resided  with  FRC,  so  generation  of  the 
Preflight  Erasable  Load  and  KSTART  shifted  to  FRC  as  the  software  capability 
was  developed  there.  However,  Erasable  Memory  Program  development  was  a CSDL 
function,  and  the  verified  and  accepted  EMP  code  was  incorporated  into  the 
KSTART  by  FRC. 

Several  unique  or  extremely  helpful  features  characterize  the  F-8  Pre- 
flight Erasable  Load  (PEL),  and  the  generation  of  its  KSTART  uplink  tape, 
specifically; 

(1)  PEL  parameters  are  expressed  in  conveniently  scaled,  physically 
significant  engineering  units. 

(2)  A DFCS  initialization  routine  translates  each  PEL  parameter  (units 
and  scaling)  into  DFCS  operational  parameters.  Factored  or  ratioed 
parameters  are  combined  into  single  operational  parameters  at  this 
time. 

(3)  Comprehensive  error  checking  and  diagnostic  indicators  are  built 
into  the  KSTART  tape  generating  programs. 

Parameters— The  basic  DFCS  parameters  are  expressed  in  conveniently 
scaled  engineering  units  and  constitute  the  erasable  load.  The  DFCS  working 
registers  (gains,  limit  levels,  coefficients)  are  defined  so  as  to  minimize 
computation  time  where  possible.  This  usually  results  in  unusual  scaling, 
e. g. , number  of  DFCS  samples  Instead  of  seconds,  or  DAC  bits  instead  of  sur- 
face degrees.  Other  working  registers  are  functions  of  basic  parameters, 
such  as  a simple  product,  or  a limit  level  that  is  computed  from  intercept/ 
slope/breakpoint  values.  Also  a working  register  might  contain  an  address 
constant,  selected  from  a table  in  accordance  with  certain  rules.  To  accom- 
plish the  interface  between  working  registers  and  erasable  load  parameters, 

F-8  DFBW  utilizes  an  initialization  routine.  By  having  an  initialization  rou- 
tine available  to  translate  the  working  registers,  the  engineer  preparing 
KSTART  tapes,  or  changing  parameters  manually  via  the  DSKY  during  a simulation, 
can  continue  to  think  in  basic  engineering  terms.  This  is  especially  important 
in  F-8  DFBW,  since  much  of  the  development  is  performed  on  hybrid  simulators 
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where  the  DSKY  interface  is  the  only  practical  interface  for  changing  DFCS 
parameters.  By  keeping  PEL  specifications  simple  and  by  formulating  them  in 
engineering  terms  for  both  physical  feel  and  visibility,  the  possibility  for 
error  is  greatly  reduced.  Since  programmed  and  verified  initialization  soft- 
ware is  involved,  reliable  and  complete  changes  are  made  quickly  by  single- 
parameter data  entries  even  though  that  parameter  exhibits  multiple  usage. 

KSTART  Generation- — Two  off-line  diagnostic  programs,  DOWNDIAG  and 
SHERLOCK,  developed  by  NASA/FRC,  contribute  significantly  to  the  generation 
of  a highly  reliable  PEL  and  its  KSTART  tape.  Operational  use  of  these  pro- 
grams is  shown  schematically  in  Fig.  3. 

DOWNDIAG  checks  the  erasable  downlink  list  specification  against  format, 
opcode,  address,  and  keypunch  errors.  It  punches  the  Erasable  Downlist  (EDL) 
and  Downlink  Processor  (DLP)  decks  only  after  error-free  input  is  provided. 

The  DLP  deck  is  used  for  post-flight  or  post-simulation  downlink  processing. 

The  EDL  deck  is  integrated  with  the  DFCS  parameter  deck  for  input  to  SHERLOCK. 

SHERLOCK  likewise  checks  against  keystroke,  octal,  and  address  errors, 
but  more  significantly  performs  comprehensive  reasonability  checks,  e.g., 
minimum/maximum  range  or  compatibility  bet.ween  related  elements.  SHERLOCK 
also  extracts  filter  polynomial  roots,  checks  the  stability  of  poles,  and 
checks  zeroes  against  minimum/maximum  ranges.  Diagnostic  printouts  must  be 
answered  by  corrections  to  the  SHERLOCK  inputs,  or  by  signed  waivers,  before 
output  decks  are  punched,  one  for  the  F-8  All-Digital  Simulator  at  CSDL,  and 
the  other  for  input  to  KPUNCH,  the  KSTART  tape  diagnostic  and  punch  program. 

KPUNCH  calculates  the  initialization  values  for  the  uplink  summation 
(UPSUM)  registers  such  that  with  a proper  uplinking  of  the  KSTART  tape,  the 
UPSTJM  registers  equal  77777  77777  when  displayed  on  the^DSKY.  Errors  generated 
during  uplinking  will  leave  numbers  other  than  7s.  KPUNCH  also  performs 
limited  diagnostic  checking  and  ultimately  punches  the  KSTART  tape,  ready  for 
uplinking  to  the  LGC  prior  to  flight. 


F-8  DFBW  Software  Package 

The  F-8  DFBW  software  package  can  be  broken  down  as  in  Table  3 (Fixed 
Memory  Allocation) , and  Table  4 (Erasable  Memory  Allocation) , The  DECS  code 
is  by  far  the  largest  single  item.  Extensive  fixed  memory  is  used  by  Display 
Interfaces  (DSKY  processing),  Interpreter/Executive,  and  IMU  Alignment.  Most 
of  this  code  was  transferred  directly  or  with  minor  change  from  the  LM  program 
for  Apollo  14.  The  Self-Test  Self-Check  code  came  from  Apollo  preflight 
erasable  code.  Roughly  half  (696)  of  the  erasables  used  are  DFCS  related,  and 
a significant  number  (389)  belong  to  the  Preflight  Erasable  Load. 


SOFTWARE  PROGRAM  CONTROL 


The  flight  software  for  F-8  DFBW  program  leans  heavily  on  the  experience 
developed  for  Apollo.  The  main  difference  between  Apollo  software  and  other 
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(previous)  software  is  that  the  Apollo  software  had  to  work  perfectly  the  first 
time  it  was  used  in  its  real  environment.  Apollo  manned  missions  had  a one- 
shot  nature  that  required  guaranteed  performance.  To  achieve  such  reliability, 
management  and  supervision  controls  were  set  up,  and  have  evolved  over  several 
years  into  a system  to  monitor  and  check  software  progress  very  closely  and  yet 
not  to  create  an  environment  that  is  oppressive  to  the  creativity,  persever- 
ance, and  dedication  of  engineers.  The  system  thus  created  has  been  proven  in 
both  developmental  and  incremental  phases  of  software.  Man -rated  flight  soft- 
ware depends  on  reliability  and  confidence  built  up  by  careful  management  and 
supervision  controls  supported  by  thorough  software  verification  using  real 
hardware  and  high-fidelity  models  in  simulation. 


Software  Management 

A successfully  managed  software  effort  must  provide: 

(1)  Realistic  estimates  of  requirements  including  manpower,  assembly 
and  simulation  budgets,  memory  allocations. 

(2)  Efficiency  in  the  development  and  verification  process  including 
non-overlapping  testing,  effective  use  of  man  and  machine  re- 
sources. 

(3)  Achievement  of  milestones  on  schedule. 

(4)  Visibility  of  the  product  including  developmental  status,  trouble 
spots,  user-oriented  operations  and  interfaces. 

(5)  Flexible  and  efficient  response  to  design  change  requests. 

(6)  Systematic  verification  procedures  at  all  module  interface  levels 
of  testing  and  performance. 

(7)  Reliability  of  final  products. 

(8)  Quality  performance  of  final  products. 

The  software  management  and  control  system  developed  for  Apollo  provided 
such  capability.  Its  selection  for  F-8  DFBW  was  a natural  outgrowth  of  success- 
ful prior  experience  with  it.  Changes  were  made,  but  only  when  the  differing 
situations  Indicated  a modified  approach. 

The  management  and  control  of  flight  software  is  directed  toward  the 
timely  preparation  of  two  end  items:  a software  program  assembly  from  which 

the  read-only  core-rope  memory  is  manufactured,  and  a software  preflight  eras- 
able-load assembly  from,  which  a KSTART  tape  is  manufactured  to  initialize  the 
erasable  read-write  memory.  Operational  efficiency,  performance  capability, 
operational  flexibility,  and  overall  reliability  are  demanded  of  both  the  fixed 
and  the  erasable-memory  assemblies,  since  they  complement  each  other  in  terms 
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of  overall  performance.  Timely  availability  is  likewise  a requirement  in  terms 
of  schedule  milestones.  Changes  and  additions  to  the  baseline  design  must  be 
implemented  with  the  same  quality  and  timely  control. 


Organization  and  Controls 

The  software  organization  used  by  F-8  DFBW  is  relatively  simple*  The 
Project  Manager  is  the  customer’s  contact  point.  The  Project  Manager  inter- 
faces with  the  Software  Manager,  who  interfaces  with  the  engineers  doing  the 
software  design,  coding,  and  verification.  Both  of  the  latter  Interface  with 
Assembly  Control,  which  is  responsible  for  the  assembly  process.  The  types  of 
control  machinery  available  to  the  Project  Manager  and  the  Software  Manager  are 
as  follows: 

(1)  Software  Specification  Document  is  the  product  specification  to 
which  the  software  must  conform. 

(2)  PCR — a Program  Change  Request,  that  officially  changes  the  Software 
Specification  (must  be  signed  off  by  customer.  Project  Manager, 
and  Software  Manager). 

(3)  PCM — a Program  Change  Notice,  similar  to  a PCR  but  deemed  impera- 
tive by  CSDL  (must  be  signed  off  by  Project  Manager  and  Software 
Manager) . 

(4)  Anomaly^— a request  to  fix  an  error  in  the  program  (must  be  signed 
off  by  Project  Manager  and  Software  Manager). 

(5)  ACB — an  Assembly  Control  Board  request,  identifies  a necessary 
program  change  that  is  not  a specification  change  (must  be  signed 
off  by  Software  Manager). 

Under  Configuration  Control,  all  coding  changes  and  additions  must  be  covered 
by  one  of  the  above  forms  of  approval  before  the  Assembly  Control  Supervisor 
will  incorporate  the  code  into  the  assembly. 


Assembly  Control 

The  Assembly  Control  functions  in  Apollo  were  highly  structured  and  very 
formal  for  the  mainline  program  assemblies.  There  was  an  Applications  Program- 
ming Development  and  Testing  Group  for  the  two  major  assemblies.  A System 
Integration  Programming  Group  served  for  all  assemblies,  but  the  major  assem- 
blies had  separate  Assembly  Control  Supervisors.  Finally,  the  Assembly  Control 
Service  Group  served  all  needs. 

The  software  generation  process  is  illustratively  simplified  in  Fig.  4. 

A coding  task  is  routed  to  the  appropriate  programming  group  for  code  design. 
Discussions  with  the  other  groups  might  follow.  Completed  code  is  submitted  to 
Assembly  Control  where  it  is  either  accepted  for  the  next  revision  or  returned 


174 


for  corrections.  At  appropriate  times,  the  assembly  update  deck  is  submitted 
to  make  the  new  revision.  The  Assembler  output  is  examined  by  Assembly  Control 
and  errors  are  either  fixed  or  referred  back  to  the  coder  for  rectification. 
Notification  of  a good  assembly  is  given  to  coder/testers  who  submit  simulation 
test  runs.  If  tests  do  not  work  correctly,  corrected  code  is  submitted  for  the 
next  revision.  On  receipt  of  good  results,  a new  coding  task  is  begun. 

In  F-8  DFBW,  with  a total  prograniming  team  of  about  nine  people , such 
structuring  was  not  practical  or  necessary.  Nevertheless  the  spirit  of  the 
Assembly  Control  process  was  maintained.  One  member  of  the  DFBW  team  was  desig- 
nated Assembly  Control  Supervisor,  but  his  activities  spanned  all  four  of  the 
structured  areas  as  time  permitted  and  activity  made  necessary.  For  example, 
he  monitored,  coordinated  and  submitted  all  assembly  changes,  maintained  the 
Simulator  test  packages,  published  the  assembly  documentation,  maintained  and 
verified  IGC  System  software,  coded  and  verified  some  Applications  code,  and 
participated  in  Level  4/Level  5 testing.  The  other  team  members  likewise  found 
their  activities  spanning  the  four  groups  as  specific  needs  came  and  went,  each 
contributing  in  areas  of  greatest  interest  and  ability. 


Controllable  Items 

In  addition  to  the  main  program  assembly,  there  are  also  other  areas 
where  control  procedures  must  apply.  These  are  the  Preflight  Erasable  Load 
Assembly,  Simulator  Test  Packages,  Off-line  Program  Assemblies,  and  Erasable 
Memory  Programs. 

A Preflight  Erasable  Load  Assembly  is  associated  with  each  mainline  pro- 
gram revision,  and  consists  of  data  constants,  branch-control  constants,  and 
address  constants  that  are  defined  in  the  mainline  revision.  The  Preflight 
Erasable  Load  Assembly  is  used  to  generate  data  and  address  decks  for  Simulator 
test  runs  and  it  is  essential  that  these  decks  be  error  free. 

The  Simulator  Test  Package  supports  the  software  testing  and  verification 
by  providing  a common  library  of  test  case  decks.  Functionally  the  decks  cover 
three  categories:  program  initialization,  simulation  control,  and  edit  control. 

Operationally  the  decks  are  invoked  in  suitable  configurations  at  run  time  by 
single  cards  in  the  user’s  test  deck. 

Off-line  Assemblies- — As  the  mainline  program  matures,  off-line  versions 
are  useful  to  check  out  code  prior  to  updating  the  mainline  assembly.  Once  the 
design  and  coding  is  checked  out,  a simple  transfer  of  appropriate  code  is  made 
to  the  mainline  assembly.  In  F-8  DFBW  two  examples  occurred;  one  was  to  check 
out  a major  design  modification  in  the  BCS  downmode  logic  just  prior  to  Con- 
figuration Control,  and  the  other  was  to  create  a testing  and  training  tool 
capable  of  failing  input/output  discretes  via  DSKY  commands. 

Erasable  Memory  Programs — Erasable-memory  programming  is  a tool  enabling 
a limited  flexibility  for  modifying  core-rope  program  flow.  A block  of  code  is 
designed  to  reside  in  and  operate  from  erasable  memory,  and  a way  is  devised  to 
access  the  code  from  the  existing  rope. 
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Assembly  Control  Tools 


Assembler — Sinee  the  software  was  not  written  in  a Higher  Order  Lan- 
guage, a sophisticated  assembler  was  of  utmost  importance.  The  Assembler  is 
by  far  the  most  powerful  tool  in  the  Assembly  Control  process.  The  lengthy 
evolutionary  period  of  Apollo  has  generated  many  fine  features. 

Diagnostic  Packager— The  Assembler  diagnoses  faulty  coding  in  both  basic 
and  interpretive  languages.  It  issues  diagnostic  messages  about  refer- 
ences to  non-existent  variables,  multiple  definitions,  illegal  sequences 
of  instructions,  improper  erasable-bank  or  fixed-bank  references,  and 
many  others. 

Basic  and  Interpretive  Language The  Assembler  recognizes  two  languages: 

basic  language,  and  a list-processing  interpretive  language.  The  latter 
permits  vector  and  matrix  as  well  as  double  and  triple  precision  opera- 
tions; these  are  processed  by  the  Interpreter  software  routines  in  the 
LGC.  The  Assembler  recognizes  data  constants,  noun  and  verb  constants, 
downlink  list  specification  constants,  and  address  constants. 

Flexibility  of  Memory  Allocation — -Blocks  of  fixed-memory  programming  can 
be  referenced  to  each  other  so  that  if  a block  expands,  another  block 
need  not  be  moved  to  make  room  for  it.  Overlapping  of  program  memory  is 
flagged  if  it  occurs.  Overlapping  of  erasable  storage  (time-sharing), 
on  the  other  hand,  is  facilitated  by  the  Assembler. 

Program  Visibility  —The  Assembler  provides  complete  mnemonic  cross- 
reference  tables,  a summary  of  erasable  memory  assignments,  and  maps  of 
both  erasable-  and  fixed-memory  storage.  All  operand  references  are 
threaded,  allowing  rapid  eyeball  debugging  even  when  the  relevant  pas- 
sages are  scattered  through  hundreds  of  pages.  Word  count,  including  a 
breakdown  by  functional  area,  is  provided. 

Modularity— The  Assembler  provides  the  ability  to  separately  assemble 
and  partially  diagnose  sections  of  the  full  program.  These  can  be  coded 
separately  and  brought  together  into  full  programs  for  verification. 

Interface  with  All-Digital  Simulator— The  Assembler  output  includes  input 
information  for  the  All-Digital  Simulator,  which  is  useful  for  simulator 
initializations,  and  for  simulator  run-time  diagnostic  error  detection. 
The  S3rmbol  Table  enables  the  addressing  of  erasable  cells  and  fixed  lo- 
cations by  name,  rather  than  by  number  which  tends  to  vary  from  revision 
to  revision  as  memory  layout  is  modified.  Tapes  for  fixed-memory  loading 
of  core-rope  simulator  can  be  generated.  Constants,  bad  words  (assembler- 
detected  errors),  unused  words,  and  coding  instructions  are  distinctively 
flagged  to  permit  detection  of  such  run-time  errors  as  'executing  a con- 
stant' or  'executing  from  unused  fixed  memory'.  KSTART  tapes  can  be 
punched  directly  from  the  Preflight  Erasable  Load  Assembly  as  a feature 
of  the  Assembler. 
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Erasable  Memory  Map 


The  limited  erasable-memory  size  of  the  LGG  forced  a policy  of  cell 
sharing  as  a means  of  extending  memory  capability  in  Apollo;  extensive  cell 
sharing  was  necessary,  more  than  doubling  the  erasable  complement  and  resulting 
in  as  many  as  seven  distinct  usages.  An  erasable-memory  map  was  used  as  a 
bookkeeping  and  planning  tool.  The  map  was  looked  on  as  a short-lived  neces- 
sity, otherwise  the  cell-sharing  process  would  have  been  automated.  In  F-8  DFBW, 
even  though  memory  cell  sharing  is  limited,  the  Erasable  Memory  Map  is  an 
especially  useful  document.  A separate  map  is  prepared  for  each  erasable  bank 
by  the  Assembly  Control  Supervisor,  The  primary  allocation  is  identified  in 
the  first  column,  with  the  overlays  defined  in  the  subsequent  columns.  The  map 
simplifies  the  problem  of  assigning  multiple  use  to  cells  Or  blocks  of  cells 
and  minimizes  the  problem  of  run-time  conflicts  between  LGC  programs.  The  maps 
are  extremely  valuable  to  the  programmer  preparing  erasable  memory  code  by 
identifying  unused  blocks  of  cells  and  by  aiding  in  the  time-sharing  usage  of 
cells. 


Software  Development  Activity 

The  software  development  process,  involving  all  phases  of  software  acti- 
vity, can  be  summarized  in  Fig.  5.  All  software  design  is  based  on  written 
specification.  In  Apollo,  the  specification  was  the  seven  volume  Guidance  Sys- 
tem Operations  Plan.  In  F-8  DFBW,  the  Control  Laws,  backup  Interface  require- 
ments, pilot  interface  requirements,  and  data  retrieval  requirements  are 
prescribed  in  the  Software  Specification.  The  LGC  executive  hierarchy,  service 
routines,  interrupt  processors,  restart  routines,  downlink,  and  all  others  that 
came  from  Apollo  are  specified  by  inference  as  being  the  same  as  Apollo.  The 
few  changes  in  this  category  by  rights  should  be  documented  by  PCRs  or  ACBs. 
However  the  ultimate  documentation  in  this  area,  as  was  similarly  true  in 
Apollo,  is  the  detailed  flowchart*  Nevertheless,  in  the  software  development, 
authorization  must  exist  in  one  of  the  forms:  Software  Specification,  Program 

Change  Request,  Program  Change  Notice,  or  Assembly  Control  Board  direction. 

Another  class  of  input  to  the  Software  Development,  shown  in  Fig.  5,  is 
the  Initial  Data  Load  which  becomes  the  Preflight  Erasable  .Load.  The  load  is 
the  cumulative  array  of  values  for  control  law  parameters  and  for  other  rou- 
tines' parameters  and,  as  such,  is  jointly  specified  by  FRC  and  CSDL.  The  load 
is  revised  and  updated  to  keep  pace  with  the  software  development. 

A third  class  of  input  to  the  software  development  is  the  test  plans, 
the  most  important  one  being  the  Level  4 Test  Plan.  Test  plans  exist  at  all 
levels  and  are  the  basis  for  the  level  testing.  At  the  lower  levels,  the  plans 
are  informal  tools  to  ensure  thorough  unit  testing  by  individual  programmers. 
The  Level  3 Test  Plan  and  the  Level  4/5  Test  Plan  are  carefully  documented 
compendiums  of  specific  tests,  and  cover  all  areas  of  the  software.  The  test 
plan  is  reviewed  and  updated  by  all  concerned;  it  can  be  added  to  at  any  time 
to  include  any  overlooked  areas. 
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Continuing  in  Fig.  5,  the  software  is  designed  in  blocks  or  units  with 
each  being  tested  before  proceeding  to  the  next.  Testing  at  the  unit  level 
(Level  1/2)  is  generally  bit-by-bit  digital  simulation.  When  a sufficient  num- 
ber of  units  are  completed,  the  hardware  and  alarm  interfaces  are  tested  as 
appropriate.  These  tests  generally  involve  all  three  simulators:  the  Digital, 

Hybrid,  and  System  Test  Laboratory.  Modular  Testing  (Level  3)  commences  in  any 
given  area  when  all  units  in  a given  program  function  are  completed,  for  ex- 
ample, the  DFCS  Direct  Mode  in  the  pitch  axis.  This  level  of  testing  continues 
until  all  DFCS  modes  and  capabilities  are  completed.  Since  several  program 
areas  are  developed  in  parallel,  but  not  all  at  the  same  rate,  testing  at 
several  levels  takes  place  during  any  given  time  frame. 

When  all  major  programs  appear  to  be  essentially  completed.  Configuration 
Control  is  instituted,  officially  designating  the  start  of  Level  4,  although 
limited  Interface  testing  can  take  place  earlier.  Subsequent  to  Configuration 
Control,  all  program  changes  require  the  careful  scrutiny  and  approval  of  one 
or  more  of  the  software  supervisors,  as  well  as  the  coding  experts  in  the  areas 
affected.  Software  Specification  changes  require  a PGR.  Level  4 tests  are 
based  on  the  Test  Plan,  and  all  incorrect,  or  unexpected,  or  incomplete,  or 
anomalous  behavior  is  dociimented  in  an  anomaly  report  or  a discrepancy  report. 
Discrepancies  are  software  errors  detected'  after  Configuration  Control,  but 
prior  to  release- for-manufacture.  Anomalies  are  software  errors  detected  after 
release-for-manufacture.  Verification  at  Level  4 and  above  involves  exercising 
the  program  on  the  three  CSDL  simulators*  as  well  as  the  FRC  Iron  Bird  System. 
All  documented  anomalies  and  discrepancies  must  be  resolved.  In  some  cases 
resolution  of  a Hybrid  or  Iron  Bird  item  requires  an  attempt  to  reproduce  the 
behavior  on  another  simulator,  or  perhaps  the  Digital,  in  order  to  pinpoint  the 
cause.  When  the  cause  of  a discrepancy  or  anomaly  is  identified,  an  assess- 
ment is  made  to  determine:  (1)  the  operational  impact  when  the  problem  is 

encountered  if  the  program  is  left  as  is,  (2)  the  procedures  necessary  to  avoid 
or  to  work  around  the  problem,  (3)  the  coding  change  necessary  to  eliminate  the 
problem,  (4)  the  schedule  impact  of  implementing  and  verifying  the  coding 
change.  The  assessment  is  documented  as  a PCR,  PCN,  or  ACB  which,  if  approved, 
is  implemented  as  a fixed-coding  change.  Erasable  coding  is  not  used  at  this 
level  for  permanent  changes.  Disapproved  PCRs,  PCNs,  and  ACBs  become  program 
Notes*  Sometimes  it  turns  out  that  what  was  thought  to  be  an  anomaly,  or 
discrepancy,  was  caused  by  a simulator  bug,  or  a test  deck  error;  in  which  case 
the  problem  is  fixed  and  the  test  is  rerun. 

When  all  pending  program  changes  are  incorporated  and  tested  at  Level  4, 
and  when  no  unresolved  problems  remain,  the  program  is  ready  for  release  and 
is  declared  frozen.  A technical  review  of  the  Level  4 testing  is  held  (pre- 
FACI).  If,  in  any  areas  the  testing  appears  to  need  reinforcement,  then  new 
or  additional  Level  4 tests  are  defined.  The  Level  5 testing  consists  of  re- 
running all  of  the  Level  4 test  decks  on  the  final  version.  If  any  new  anom- 
alies or'  discrepancies  turn  up  and  are  serious  enough  to  require  a PCR,  the 
Erasable  Memory  Program  option  is  weighted  heavily  against  a manufacturing 
schedule  slip.  The  First  Article  Configuration  inspection  (FACI)  is  a formal 
review  of  all  Level  5 testing  results,  anomaly  reports,  change  requests,  pro- 
gram notes,  and  operational  restrictions.  The  end  action  of  the  FACT  is  the 
granting  of  approval  to  release  the  rope  assembly  for  manufacturing. 
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Flight  Support  Activity 


The  Flight  Support  Activity  takes  place  after  delivery  of  the  Manufactured 
rope  modules  and  centers  around  Level  6 testing  as  shown  in  Fig.  6.  The  KSTART 
tape  is  generated  from  the  Preflight  Erasable  Load  involving  the  Initial  Data 
Load  and  any  existing  Erasable  Memory  Programs.  Evaluation  involves  careful 
scrutiny  of  all  parameters,  by  computer  Program  and  by  eyeball,  to  identify  and 
assess  changes  from  the  previous  KSTART  tape.  Additionally,  the  GSDL  evaluation 
utilizes  the  Hybrid  Simulator,  the  All-Digital  Simulator,  and  the  Systems  Test 
Laboratory  hardware  installation.  The  testing  is  complemented  by  extensive 
mission-sequence  testing  on  the  Iron  Bird  Simulator  at  FRC,  and  involves  pilot 
training,  pilot  procedures,  and  system  performance.  The  test  results  are  pre- 
sented at  the  Flight  Readiness  Review  (FRR) , and  any  anomalies  resolved,  perhaps 
by  modifying  the  operational  envelope.  FRR  approval  is  required  for  flight  go- 
ahead.  Following  a successful  flight  to  test  one  DFCS  capability,  the  Initial 
Data  Load  can  be  modified  to  test  another  capability,  or  to  change  the  downlink 
coverage,  and  the  procedure  of  Fig.  6 is  repeated. 

Alternatively,  the  flight  test  results  can  indicate  a serious  need  for  a 
DFCS  capability  that  does  not  exist  in  the  rope.  In  this  case,  a PCR  is  sub- 
mitted to  request  that  the  capability  be  developed  as  an  EMP.  After  assessment, 
if  the  PCR  is  approved,  the  development  and  test  of  the  EMP  is  undertaken  as  was 
shown  in  the  previous  figure.  Fig.  5.  When  completed,  the  verified  EMP  is  in- 
corporated into  the  KSTART  tape  for  Level  6 testing. 


Software  Milestones 

The  development  activity  is  tracked  by  milestones.  Schedule  milestones 
were  not  treated  with  the  level  of  formality  accorded  their  Apollo  counterparts. 
Small  meetings  of  one  or  two  technical  personnel  with  management  personnel  marked 
many  F-8  DFBW  events.  Nevertheless,  schedule  milestones  were  vital  to  a timely 
development  and  verification  process.  The  major  milestones  are  indicated  in 
Fig.  2. 

The  Preliminary  Design  Review  (PDR) for  F-8  consisted  of  several  meetings , 
each  covering  a specific  area  of  interest.  These  were  preliminary  in  the  sense 
that  changes  were  expected  as  subcontractors  and  customer  had  the  opportunity  to 
review  carefully  each  other's  needs,  plans,  and  suggestions. 

The  Critical  Design  Review  (CDR)  also  consisted  of  several  meetings,  each 
covering  a specific  area  in  minute  detail.  The  CDRs  for  the  Control  System 
Specification  and  the  Interface  Control  Document  are  specific  examples. 

Level  1,  2,  3 Testing  (Unit  and  Modular  testing)  allows  tracking  of  units 
of  software  in  the  early  stages  of  development  when  coding  and  verification  are 
relatively  independent  of  tight  controls. 

Configuration  Control  marks  the  transition  to  tightly  controlled  software 
configuration  and  testing  procedures. 
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Level  4 Testing  (Interface  testing)  allows  tracking  of  interfaces  between 
modules  of  software.  Program  changes  require  written  approval  and  all  anomalous 
simulation  behavior  requires  documentation,  analysis,  and  resolution. 

Level  5 (Formal  testing)  allows  tracking  of  software  prototype. 

First  Article  Configuration  Inspection  (FACI)  is  a formal  review  of  all 
aspects  of  prototype  software.  The  final  action  is  the  approval  of  the  final 
assembly  for  manufacture. 

Release-for-Manufacture— -Following  FACI  approval,  a weaving  tape  is  gene- 
rated from  the  final  assembly  to  be  used  for  core-rope  manufacture. 

Level  6 Testing  (Mission  Performance  testing)  is  based  on  the  KSTART  tape 
for  the  particular  flight.  Evaluation  consists  of  exercising  the  KSTART  tape 
on  the  three  CSDL  Simulators  and  on  the  FRC  Iron  Bird  System. 

A Flight  Readiness  Review  (FRR)  is  conducted  prior  to  each  flight.  A 
statement  from  CSDL  is  required  concerning  its  review  on  the  Preflight  Erasable 
Load  and  KSTART  tape.  The  initial  FRR  had  the  longest  agenda.  The  review 
assessed  the  flight  readiness  of  the  primary  control  system,  the  backup  control 
system,  the  flight  vehicle  subsystems,  to  name  a few.  Known  anomalies  and  their 
avoidance  or  work-around  procedures  were  discussed.  Erasable  Memory  Programs 
were  explained,  both  functionally  and  operationally.  The  failure  analysis  studie 
were  reviewed,  as  well  as  available  documentation.  Flight  readiness  reviews  sub- 
sequent to  the  initial  flight  generally  consider  the  current  KSTART  tape  and  any 
newly  applicable  areas. 


SOFTWARE  VERIFICATION 


The  software  verification  process  is  vital  to  the  preparation  of  reliable 
high-quality  software.  A screening  process  is  employed,  whereby  code  is  sub- 
jected to  many  tests  representing  many  different  situations.  This  approach  to 
testing  is  one  of  diminishing  returns:  early  tests  show  up  most  of  the  coding 

errors,  but  the  later  tests  build  confidence  in  the  overall  quality  of  the  pro- 
gram assembly.  Establishing  the  proper  balance  between  insufficient  and  exces- 
sive verification  testing  is  a critical  task.  Indeed,  the  verification  process 
does  not  terminate  with  release-for-manufacture;  it  continues,  in  the  hope  of 
catching  any  remaining  errors  before  they  show  up  operationally  with  unexpected 
and  perhaps  dangerous  consequences. 

The  verification  process  cannot  be  separated  from  the  assembly  control 
process,  at  least  prior  to  release-for-manufacture.  The  ultimate  quality  and 
reliability  of  code  depends  heavily  on  the  verification  process.  The  attainment 
of  the  verification  goals  involves  far  more  than  the  execution  of  high  quality 
object  code  available  near  the  end  of  the  software  development  cycle.  Facili- 
ties are  required  in  the  early  stages  of  program  development  when  the  code 
available  is  of  low  quality  and  may  not  even  be  executable.  In  the  early  stages 
a benign  and  cooperative  environment  is  required;  it  must  provide  a detailed 
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visibility  into  the  execution  of  code.  Simplified,  but  fast-operating  environ- 
mnt  algorithms  are  desirabld.  Extensive  diagnostic  capability  is  mandatory, 
involving  both  run-time  and  post-run  software  packages.  As  code  quality  is  re- 
fined, the  environment  quality  can  be  updated  to  include  such  factors  as  sensor 
errors  and  higher  order  effects.  Ultimately  the  code  should  be  exercised  in  a 
highly  realistic  environment  including  as  much  real  hardware  as  possible. 


Software  Verification  Facilities 

Several  distinct  facilities  were  utilized  during  the  DFCS  verification 
process.  The  complementary  nature  of  their  unique  capabilities  is  significant. 
Each  has  contributed  to  the  DFCS  quality,  and  by  its  absence  would  have  affected 
the  development  adversely,  mainly  in  terms  of  schedule,  but  perhaps  even  in  terms 
of  operational  performance.  CSDL  has  utilized  the  All-Digital  Simulator,  the 
Hybrid  Simulator,  and  the  System  Test  Laboratory  facilities  for  the  software 
development  and  verification  activities.  NASA/FRC  has  utilized  the  analog 
Stage  1 engineering  simulation,  the  bench  lashup  Stage  2 hardware  integration 
simulation,  and  the  Stage  3 Iron  Bird  Simulator  for  the  systems  design,  hardware 
integration,  design  verification,  and  pilot  training/evaluation  activities. 

Each  of  these  facilities  has  contributed  to  the  overall  success  of  F-8 
DFBW,  but  certainly  the  significant  contributions  to  system  integration  have 
come  from  the  Stage  3 Iron  Bird  Simulator.  It  was  on  this  facility  that  signi- 
ficant hardware  integration  problems  were  first  encountered.  The  Stage  3 piloted 
simulations  gave  insight  for  design-change  evaluation.  Stage  3 permitted  real- 
time  demonstration  of  failure  effects,  and  permitted  engineering  preliminary 
and  final  design.  Stage  3 was  used  for  much  supportive  software  verification 
and  essentially  all  of  the  system  design  verification.  For  the  flight  testing, 
where  CSDL's  verification  role  was  supportive,  the  Stage  3 simulation  was 
especially  important  as  the  primary  design,  verification,  and  training  tool. 

The  All-Digital  Simulator  (ADS)  at  CSDL  played  the  significant  role  in 
F-8  software  design,  development,  and  verification,  primarily  because  of  the 
powerful  run-time  diagnostic  and  post-run  edit  capability,  as  well  as  features 
such  as  repeatability  and  snapshot/rollback.  Rigidly  controlled  simulator 
software  provided  a stable  environment  and  ensured  repeatability. 

The  Hybrid  Simulator  at  CSDL  was  a very  useful  tool  during  preliminary 
verification,  primarily  because  of  its  real-time  interactive  capabilities.  Its 
role  was  somewhat  diminished  because  CSDL  did  not  have  DFCS  design  responsi- 
bility, which  is  where  the  real-time  Interactive  aspects  of  hybrid  simulation 
can  vastly  improve  the  control-system  designer's  efficiency.  However,  on  two 
separate  occasions,  one  being  the  time-critical  development  period  between 
Stage  2 and  Stage  3 simulation,  NASA/FRC  came  to  CSDL  and  conducted  basic  and 
detailed  design  on  our  Hybrid  facilities. 

Piloted  simulations  early  in  the  development  phases  can  improve  the 
overall  quality  of  the  end  item,  especially  when  schedules  are  tight.  Pilot 
contributions  cover  a wide  range  of  experience  including  such  items  as  human 
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factors  suggestions,  functional  change  requests,  performance  and  handling 
qualities  evaluation,  and  safety  considerations. 

The  complementary  nature  of  all-digital,  hybrid,  and  hardware  integration 
facilities  is  important.  The  ADS  provides  diagnostic  and  edit  capability  plus 
detailed  hard-copy  for  documentation.  The  Hybrid  Simulator  is  unmatched  in  its 
real-time  interactive  capabilities  for  preliminary  design,  parameter-variation, 
and  sensitivity  studies.  The  hardware  integration  facility  represents  the  ulti- 
mate interface  verification  tool  short  of  flight  test.  Here,  interfaces  are 
actually  mated,  often  for  the  first  time.  Failures  can  be  studied  and  pilot-in- 
the-loop  evaluations  based  on  a maximum  hardware  complement  can  be  performed. 
Each  of  the  design,  development,  verification,  and  training  tools  can  play  a 
key  non-overlapping  role.  It  is  the  complementary  nature  of  each  facility  which 
should  be  emphasized  and  utilized  for  greatest  program  efficiency  and  end-item 
quality. 

A brief  description  of  each  of  these  facilities  follows. 

CSDL  All-Digital  Simulator  —The  Apollo  Digital  Simulator  is  a basic  tool 
developed  and  employed  primarily  to  support  the  design,  development,  and  veri- 
fication of  Apollo  Guidance  Computer  (AGC)  programs.  The  simulator  is  entirely 
digital  and  consists  of  a number  of  programs  implemented  on  a general  purpose 
digital  computer.  It  simulates  the  operation  of  the  AGC  in  storage  layout,  and 
in  detailed  arithmetic  and  logical  operation.  Consistent  with  one's  objectives, 
mathematical  and  logical  models  ranging  from  rudimentary  to  comprehensive  may  be 
selected  to  simulate  the  hardware  and  flight  environment  within  which  the  AGC  an 
its  coding  operate.  For  the  F-8C,  only  the  rigid  body  degrees  of  freedom  are 
mechanized  and  there  is  no  takeoff  or  landing  capability.  The  BCS  flight  contro 
system  is  not  simulated,  so  controlled  flight  is  possible  only  in  the  DFCS  modes 
The  Pilot  Action  Simulator  provides  open-loop  actions  such  as  stick  and  rudder 
deflections,  push  button  and  trim  switch  activity,  and  DSKY  operations.  In  ad- 
dition, the  simulator  has  numerous  on-line  diagnostic  features,  a snap shop /roll- 
back capability,  and  extensive  post-run  edit  capability  available.  The  edit 
package  provides  for  flexible  run-time  data  storage  and  for  post-run  data  retrie 
al.  The  user  has  the  choice  of  using  standard  edit  programs  or  of  writing  his 
own.  Extensive  edit  programs  for  plotting,  computational  verification,  and 
formatting  were  developed  for  F-8  formal  verification.  Summary  printing  Includes 
data  on  DFCS  mode  changes,  timing,  and  computational  delays.  Plot  variables  in- 
clude numerous  DFCS  and  environmental  quantities.  Timing  data  indicating  duty 
cycle  and  job  activity  is  plotted,  A downlink  processor  edit  was  prepared  to 
verify  proper  downlink  operation.  The  simulation  system  is  Illustrated  schemat- 
ically in  Fig.  7. 

The  CSDL  Hybrid  Simulator — -The  Hybrid  Simulator  is  a combination  of 
selected  flight  hardware  used  in  concert  with  analog  and  digital  computers  to 
provide  real-time  simulated  flight.  The  flight  hardware  consists  of  an  LGC 
computer,  a DSKY,  and  the  coupling  data  units.  The  LGC  memory  is  replaced  by 
a Core  Rope  Simulator  (CRS),  which  provides  a complete  erasable  memory  as  well 
as  helpful  features,  such  as  the  ability  to  monitor  and  change  location  con- 
tents, to  stop  at  a location  address,  or  to  single-step  the  program.  The  IMU 
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is  simulated  with  special-purpose  electronics.  Elements  needing  precision  of 
storage,  as  the  trajectory  dynamics,  the  aerodynamics,  and  the  rotational 
transformations,  are  simulated  in  an  XDS  9300  digital  computer.  The  highr 
frequency  actuator  dynamics,  the  BCS  loops,  and  some  discrete  logic  are  simu- 
lated on  the  analog  computer.  The  algorithms  for  BCS  control  and  BCS  downmode- 
trim  initialization  are  simulated,  but  the  cross-channel  comparator  and  the 
hydrologic  subsystems  of  the  F-8C  are  not  modelled.  Also,  provision  is  not  made 
for  a parking,  landing,  or  takeoff  capability.  A minimal  cockpit  uses  the 
Apollo  three-axis  rotational  hand  controller  in  place  of  stick/pedal  controls. 
Cockpit  instrvimentation  Includes  artificial  horizon,  altitude,  airspeed,  rate- 
of-climb,  % thrust,  g,  angle  of  attack,  and  a mockup  Mode  And  Power  Panel  for 
real-time  man-in-the-loop  simulations.  Strip-chart  recordings  and  initializa- 
tion printout  are  the  only  hard-copy  output.  The  Hybrid  Simulator  runs  in 
real  time  to  allow  man-in-the-loop  testing,  on-line  debugging,  and  flexibility 
in  verification  procedures.  The  LGC  can  function  alone  or  with  the  Simulator 
providing  an  environment ; in  the  former  mode  it  is  available  independently  of 
the  availablity  of  the  hybrid  facility.  Reproducibility  is  not  in  general 
possible,  but  this  is  an  advantage  in  that  a realistic  randomness  is  introduced 
into  the  testing. 

CSDL  System  Test  Laboratory— The  System  Test  Laboratory  (STL)  is  an 
Apollo  hardware  integration  facility.  A real  IMQ ’interfaces  with  the  LGC,  CRS, 
and  DSKY.  Uplink  and  downlink  are  operational.  Channel  Inbit  discretes  can  be 
set  or  cleared  manually  and  Independently.  The  aircraft  and  BCS  systems  are 
not  simulated.  A trace  capability  is  available  via  the  Apollo  CORONER  and  off- 
line processing;  this  is  the  only  hard-copy  output  from  this  facility. 

NASA/FRC  Stage  1 Simulator-— The  Stage  1 Simulator  was  a preliminary  de- 
sign tool  used  to  develop  the  flight  control  system  specification  equations. 

Simple  analog  models  and  sample-and-hold  networks  were  utilized.  Linear  analysis 
based  on  continuous  and  sample-data  control  system  design,  using  root  locus 
and  w-plane  techniques,  provided  backup  for  the  simulation  effort, 

NASA/FRC  Stage  2 Simulator- — The  Stage  2 Simulator  was  a hardware  inte- 
gration and  preliminary  design  evaluation  facility.  Breadboard  lashup  of  major 
hardware  components  was  first  performed  here.  The  LGC,  the  Program  Analyzer 
Console  (PAC,  equivalent  to  the  CRS),  DSKY,  IMU  Glmbal  Angle  Simulator  (GAS), 
and  CDU  package  were  involved.  Aircraft  and  aero-surface  servo  actuator  d3mamics 
were  modelled  on  a small  analog  computer.  A rudimentary  version  of  the  DFCS  and 
Operating  System  software  participated. 

NASA/FRC  Stage  3 Simulator-— The  Stage  3 (or  Iron  Bird)  Simulator  is  an  F-8C 
airframe  that  includes  all  key  hardware  in  the  configuration  of  the  flight 
article,  including  the  pallet  mounting  of  the  LGC  computer,  IMU,  and  CDUs.  The 
BCS  electronics,  power  supplies,  and  hydraulics  are  flight-article  type  systems. 
The  manufactured  core-rope  or  PAC  software  can  be  used  as  the  LGC  memory.  Simu- 
lated trajectory  d3mamics  and  aerodynamics  permit  closed-loop  simulations  using 
the  GAS.  Simple  external  visuals,  sideslip  angle  and  horizon  line  with  sky/ 
earth  differentation,  are  provided  on  a TV  screen  mounted  on  the  aircraft  nose. 
Access  to  LGC  and  flight  control  system  variables  is  by  means  of  downlink  with 
post-rim  editing  or  by  DSKY  display. 
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Software  Verification  Testing 

cit  is  difficult  to  separate  software  development  and  software  verifica-r 
tion  since  both  go  hand  in  hand  throughout  the  development  phase.  To  consider 
software  verification  it  is  necessary  to  consider  software  development.  Generally 
speaking,  there  are  two  categories  of  software  design  changes  that  contribute  to 
program  construction. 

(1)  Developmental  changes  - these  are  creation  of  a new  program  or  a new 
routine,  or  extensive  changes  within  an  existing  program  or  routine. 

(2)  Incremental  changes  - these  are  modifications  to  existing  code  that 
cause  small  alterations  and  repercussions. 

Clearly,  a Developmental  change  has  a major  impact  on  the  existing  program  and 
requires  an  extensive  testing  approach  to  assure  that  the  new  code  works  properly 
and  does  not  interfere  with  other  existing  coding.  It  is  equally  clear  that  an 
Incremental  change  has  a minor  Impact  on  the  existing  code  and  requires  a local- 
ized testing  approach.  This  is  sort  of  by  definition.  However,  it  is  not 
always  clear  into  which  of  the  two  categories  a given  software  change  should  be 
placed.  Classification  is  a difficult  problem  and  requires  experience  and 
thorough  knowledge  of  the  programs.  For  example,  a one  word  change  could  re- 
quire extensive  testing  if  that  word  were,  say,  a sample  period  affecting  event 
timing.  On  the  other  hand,  the  replacement  of  one  Boolean  relationship  by 
another,  involving  perhaps  30  words,  could  be  local  in  effect  and  require  only 
local  testing.  Thus,  the  full  arsenal  of  testing  is  brought  to  bear  on  Develop- 
mental software,  while  a subset  is  used  for  Incremental  software. 

Developmental  Software  Testing — ^In  order  to  test  out  developmental  changes, 
the  six  official  levels  of  testing  are  normally  performed.  These  are  Unit  test- 
ing (Levels  1 and  2) , Modular  testing  (Level  3) , Interface  testing  (Level  4) , 
Formal  testing  (Level  5),  and  Mission  Performance  testing  (Level  6).  The  major- 
ity of  the  F-8  DFBW  programming  effort  falls  into  the  developmental  category,  as 
exemplified  by  the  flight  control  coding,  input/output  processing,  ground  test 
programs,  and  special  routines.  Design  changes  that  occur  late  in  the  develop- 
ment cycle  are  often  accorded  the  Developmental  treatment.  Erasable  Memory 
Program  design  is  also  in  this  category,  although  there  have  been  exceptions. 

Incremental  Software  Testing — -Incremental  changes  require  adequate  testing 
to  assure  that  all  paths  in  the  program  affected  by  the  change  are  exercised.  , 
This  may  necessitate  designing  new  tests  for  specific  code  changes.  Incremental 
testing  involves  some  combination  of  Unit  testing.  Modular  testing,  and  Interface 
testing.  Since  all  incremental  changes  become  part  of  the  program  rope,  they 
are  automatically  subjected  to  Level  5 and  Level  6 testing. 

There  have  been  a number  of  incremental  changes  in  F-8  DFBW.  Initially, 
much  of  the  software  (about  60%)  came  from  the  Apollo  Lunar  Module  Program. 

Many  areas  of  the  code  required  minor  Incremental  changes  to  meet  F-8G  requirernem 
Late  in  the  development  cycle,  especially  as  the  release-for-manufacture  date 
approached,  changes  even  to  flight  control  code  can  often  be  treated  as  incre- 
mental, especially  if  significant  Level  4 interface  testing  has  already  been 
completed. 
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Some  Erasable  Memory  Programs  have  been  classified  as  Incremental.  In 
one  case,  two  lines  of  code  were  added  to  an  existing  EMP  to  create  the  one- 
pulse  rudder  pedal  deadband.  The  other  case  was  a preflight  checkout  program. 
These  have  received  minimal  Level  4/5  testing.  Conversely,  other  EMPs  involved 
significant  design  changes  deeply  imbedded  in  Interface  or  systems  code:  para- 

bolic shaping  of  stick  Inputs,  or  restart-triggering  of  BCS  downmodlng.  These 
have  received  significant  Level  4/5  testing,  being  developmental  in  nature.  j 

' ''  ' 

Special  Testing — There  are  a number  of  special  testes  deserving  of  mention 
that  establish  confidence  in  the  flight  software  mainly  by  falling  to  find  a ' 
fault  rather  than  by  exhaustively  proving  every  possibility,  ihis  afpproach  is 
in  general  true  when  the  number  of  ways  to  exercise  the  code  becomes  unwieldy. 
The  fact  that  interaction  between  the  Executive,  interrupt  processors,  and  Ser- 
vice routines  falls  into  this  category  can  be  overlooked.  A specific  example 
is  restart  testing  where  a large  number  of  artificially  generated  asynchronous 
time- triggered  and  location-triggered  interrupts  exercise  the  restart  protection 
mechanism.  Stress  testing  involves  testing  operational  sequences  under  abndrmal 
conditions.  Potential  anomaly  testing  attempts  to  duplicate  the  event  sequences 
which  led  to  questionable  behavior  on  another  hybrid  facility.  Hybrid  testing 
occasionally  encounters  unexpected  behavior  that  is  usually  a hardware  hroblem, 
but  can  be  a software  problem.  If  a problem  is  found,  digital  testing  gives 
conclusive  evidence.  Alternatively,  if  no  problem  is  found,  a iijieasure  of  con- 
fidence is  restored.  j 

An  'eyeballing’  effort  was  performed  on  the  E-8  DBFW  assembly,  just  prior 
to  release.  Experienced  Apollo  programmers  were  assigned  sections  of  the  code 
to  eyeball  for  errors,  based  on  their  accumulated  experience. / Several  errors 
were  uncovered,  although  off-nominal  operational  procedures  would  have  been 
needed  to  encounter  difficulties.  The  fact  that  errors  were  found  gave  weight 
to  the  effort  as  a worthwhile  task.  The  absence  of  any  serious  errors,  and  the 
minimal  number  of  errors  encountered,  added  to  the  confidence  level  being  built 
by  the  verification  process.  ' 


Input  and  Output  Discrete  Failure  Effects 

A formal  failure  effects  investigation  was  conducted  late  in  the  develop- 
ment cycle  by  CSDL  and  by  other  systems  contractors.  All  interfaces  were 
studied  for  fail-on  and  fail-off  effects.  Engineering  analysis  was  the  primary 
investigative  tool,  but  simulated  failures  were  utilized  whenever  pllot-in-loop 
problems  were  expected.  To  this  end,  a special  version  of  the  mainline  program 
was  created  for  the  Iron  Bird  and  was  given  the  capability  to  fail  any  selected 
input/output  discrete  in  the  off-state  or  on-state.  Failures  were  introduced 
during  Iron  Bird  piloted  simulations  by  a test  engineer  at  the  DSKY.  The  capa- 
bility enabled  pilot  training  in  recognition  and  recovery  procedures. 

An  important  conclusion  of  the  failure  analysis  is  that  such  studies 
should  be  initiated  early  in  the  preliminary  design  phase  so  that  failure  effects 
can  be  recognized  and  avoided  by  careful  design  of  hardware,  software,  and 
Interfaces.  Early  recognition  leads  to  design  changes  that  often  can  be  incor- 
porated at  no  additional  cost,  whereas  late  recognition  can  be  quite  expensive. 
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Erasable  Memory  Programs 

'The  concept  of  an  Erasable  Memory  Program  only  has  application  In  refer- 
ence to  a fixed  memory  computer  when  the  capability  to  manufacture  a new  fixed 
memory  is  no  longer  available.  Certainly,  as  long  as  the  capability  does  exist, 
the  redesign  of  a portion  of  the  program  or  the  inclusion  of  a new  portion  poses 
no  particular  problem  even  in  a relatively  mature  program.  In  F-8  DFBW  for  ex- 
ample, the  result  of  early  Iron  Bird  simulations  uncovered  a hardware  interface 
problem  in  that  the  anti-dropout  filter  in  the  CDU  error  counters  Interfered 
with  restart  recovery.  Since  the  software  was  still  under  development,  a 
straightforward  redesign  of  the  restart  recovery  routine  was  mdertaken,  in- 
cluding redevelopment  and  verification.  On  the  other  hand,  when  the  ability 
to  remanufacture  the  rope  memory  is  gone,  it  is  necessary  to  resort  to  an  arti- 
fice, like  erasable  memory  programming,  if  any  change  is  to  be  incorporated  into 
the  program  flow.  If,  however,  one  is  dealing  with  a programmable  memory  com- 
puter, then  post-release  software  changes  are  treated  the  same  as  pfe-release 
software  changes.  The  purpose  of  this  section  on  EMPs  then  is  to  illustrate  by 
example  that  sufficient  cause  for  software  changes  can  and  will  arise  after 
program  release,  and  to  describe  the  F-8  DFBW  experience. 

Some  of  the  late  Stage  3 Iron  Bird  discoveries  were  not  compatible  with 
software  development  schedules,  bound  as  they  were  by  the  anticipated  shutdown 
of  the  core-rope  manufacturing  facilities.  Erasable  memory  programming  and 
major  hardware  changes  were  required  instead.  For  example,  piloted  simulations 
in  early  1972  indicatad  pilot-response  problems  with  certain  computer  failures. 
The  work-around  concept  was  straightforward  and  a software  change  could  have 
been  made,  except  that  the  DFCS  was  no  longer  software;  core-rope  manufacture 
was  under  way.  Fortunately,  an  Erasable  Memory  Program  (EMP-001,  Restart 
Downmoding  to  BCS)  could  do  the  job,  so  remanufacture  was  not  necessary.  How- 
ever, the  design  and  especially  the  verification  tasks  were  much  tougher  for 
the  EMP  than  they  would  have  been  for  the  fixed-memory  equivalent,  a character- 
istic of  most  erasable  memory  programming.  Nevertheless,  the  flexibility  pro- 
vided by  last-minute  software  changes  represents  a major  selling  point  for 
digital  flight  control. 

Design  changes  to  minimize  the  effects  of  stick/pedal  input  quantization 
were  not  foinnalized  until  after  the  first  flight.  Hardware  changes  had  been 
made  earlier,  prior  to  core-rope  manufacture,  but  these  proved  to  be  inadequate. 
Again,  an  Erasable  Memory  Program  (EMP-004,  Parabolic  Stick  Shaping)  provided 
an  acceptable  approach,  but  the  fixed-memory  equivalent  would  have  been  easier 
to  design,  develop,  and  verify.  Also,  the  DFCS  computational  burden  would  have 
been  lower  with  the  equivalent  fixed  memory  code,  and  operational  aspects  would 
have  been  simpler. 

Problems  do  not  always  show  up  during  the  systems  analysis  and  preliminary 
design  phases,  no  matter  how  detailed  the  activity,  but  instead  crop  up  during 
the  hardware  integration  phase,  or  even  worse,  conceal  their  identity  until  the 
flight  test  phase.  F-8C,  during  high-q  flight  for  example,  encountered  a single- 
pulse  null  shift  in  the  output  from  the  pedal  LVDT,  which  supplies  the  rudder 
pilot  commands  to  the  DFCS.  The  phenomenon  apparently  has  something  to  do  with 
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airframe  distortion  at  high-q  flight  conditions.  Neither  the  Stage  3 Iron  Bird 
Simulator  nor  preliminary  analysis  models  could  indicate  such  a phenomenon.  In 
this  case,  the  hardware  problem  of  rudder  bias  shift  was  eliminated  by  software, 
by  inserting  a one-pulse  deadband  (EMP-007 , Single-pulse  Pedal  Deadband) . There 
is  a real  motivation  for  a flight  test  phase,  however  brief,  between  the  proto- 
type and  production  software. 


CONCLUDING  REMARKS 


The  F-8  DFBW  is  an  experimental  digital  fly-by-wire  testbed  flight  control 
system,  implemented  with  Apollo  off-the-shelf  hardware.  Existing  off-the-shelf 
software  and  software  control  techniques  were  dictated  by  hardware  as  well  as 
manufacturing  schedule  limitations.  Software  design  was  bottom-up.  Time- 
efficient  code  was  important  because  of  LGC  speed.  (Some  of  the  techniques 
discussed  would  not  be  applicable  for  a modem,  faster,  all  core  computer.) 
Despite  the  LGC  fixed  memory,  post-manufacturing  design  changes  to  the  Specifica- 
tion were  possible  through  Erasable  Memory  Programs.  Proof  of  the  benefits  that 
accrue  from  good  software  control  and  from  careful  and  thorough  verification 
testing  is  evidenced  by  the  F-8  DFBW  flight  test  program  results;  In  a year  and 
a half,  42  flights,  totaling  58  hours  of  flight  time,  were  made  successfully 
without  any  DFCS  inflight  software  failures  or  performance  surprises. 
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TABLE  1 


APOLLO  HARDWARE  USED  IN  F-8  DFBW 


LGC 


DSKY 


IMU 


CDU 


PIPA  - 


PSA 

PTA 


LM  Guidance  Computer  (approximately  2k  of  erasable  and  36k  of 
programmable  fixed  core-rope  memory;  programmable  hardware- 
interrupt  and  software-executive  systems;  hardware  restart 
logic,  etc.)- 

(LM)  Display  and  Keyboard  (three  5-diglt-plus-sign  display 
windows;  miscellaneous  warning  lights;  keyboard  Including  0 
through  9,  +,  PRO  (proceed),  ENTR,  CLR  (clear),  VERB,  NOUN, 
etc;  the  DSKY  is  the  computer /astronaut  or  computer /ground 
crew  Interface) . 

Inertial  Measurement  Unit  (a  jthree-gimballed  gyroscopically- 
stabilized  platform  for  the  PIPA  accelerometers;  gimbal  angle 
resolver  and  PIPA  signals  ultimately  interface  with  the  LGC; 
several  platform  alignment  techniques  are  under  LGC  software 
control) . 


Coupling  Data  Unit  (for  analog-to-digital  conversion  of  IMU 
gimbal  angle  indications;  for  digital-to-analog  conversion 
of  LGC  computer  outputs;  for  control  of  IMU  moding;  includes 
failure  detection;  used  to  derive  body  axis  angular  rates) . 

Pulsed  Integrating  Pendulous  Accelerometer  (three  mutually- 
perpendicular  contact-acceleration-sensing  and  incremental- 
velocity-  indicating  devices  located  on  the  IMU  stable  member, 
with  a direct  LGC  interface;  used  to  derive  body  axis  normal 
and  lateral  acceleration) . 

Power  and  Servo  Assembly  (power  supplies,  amplifiers,  etc., 
for  inertial  subsystem) , 

Pulse  Torque  Assembly  (input/output  processing  for  inertial 
subsystem) . 
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TABLE  2 


HARDWARE  UNIQUE  TO  F-8  DFBW 


MAPP 

IFB 

BCS 

DLC/IFR 

GSE 

SPCC 

CCS 


Mode  and  Power  Panel  (computer  and  IMU  power  control,  auto- 
pilot gain  and  mode  select /indicators,  warning  indicators, 
etc. 

Interface  Box  (junction  box  containing  an  Apollo  DAC  stick/ 
pedal  comparators,  special  amplifiers,  etc>). 

Backup  Control  System  (triply-redundant  stick/pedal  to  aero- 
surface  open-loop  control,  with  trim,  hydrologic  comparator; 
cross-channel  comparator;  etc.). 

Downlink  Converter/Inflight  Recorder  (100  word-pair  list 
every  2 seconds  on  a 20ms  Intertupt;  recording  on  FM  tape 
for  post-flight  processing/review) . 

Ground  Support  Equipment  (the  Apollo  Program  Analyzer  Console 
(PAC)  for  simulating  LGC  hard-wire  rope  memory;  the  Uplink 
Converter  (ULC)  for  preflight  erasable  loading  and  for  DSKY- 
type  program  control  via  tape;  the  Ground  Test  Cart  containing 
downlink  converter /groimd  recorder,  miscellaneous  switches 
and  indicators;  etc.). 

Servo  Pressure  Control  Console  (PRI  select/indicators  for 
each  axis;  servo  pressure  switches  and  indicators  for  each 
BCS  servo-valve  and  for  PCS  servo-valve  pairs;  each  switch 
has  three  positions:  OFF  which  disables  that  valve,  AUTO 

which  enables  that  valve,  and  MAN  which  overrides  any  auto- 
matic moding  and  locks  that  valve  into  the  active  state) . 

Coolant  Control  System  (coolant  for  IMU,  computer,  etc.). 
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TABLE  3 


F-8  DFBW  FIXED-MEMORY  ALLOCATION 


F-8  DFBW  Flight  Control  System  (total)  5586 

Body  Rate/Acceleration  Feedback  320 
Generalized  Feedback  Filters  1930 
Pilot  Stick/Pedal  Processing  168 
Control  Loop  Equations  1178 
Channel  Monitor  Routine  523 
Galn/Mode  Change  Routine  985 
Inltlallzatlon/Restarts/Mlscellaneous  482 

Ground  Test  Programs /Extended  Verbs  768 
Self  Test/Check  1436, 
Fresh  Start/Restart/V37/etc.  853 
Display  Interfaces/Pinball/etc.  3578 
Interpreter/Executive/Waitllst/Dovmllnk/Uplink/ etc.  3830 
IMU  Alignment,  Compensation,  and  Tests/T4RUPT  3263 


TOTAL  F-8  DFBW  FIXED-MEMORY  USED 

TOTAL  LGC  FIXED-MEMORY  (36  FBANKS  AT  1024) 


19314 

36864 
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TABLE  4 


TOTAL 

TOTAL 


F-8  DFBW  ERASABLE-MEMORY  ALLOCATION 


Preflight  Erasable  Load  (total) 

389 

F-8  DFBW  Flight  Control  System 

169 

IMU  Compensation/Alignment 

33 

Erasable  Downlink  List 

100 

Erasable  Memory  Programming  (EMP-001,4,7) 

87 

F-8  DFBW  Flight  Control  System  Working  Registers 

321 

Extended  Verbs /Ground  Test  Prog/Mlscellaneous 

50 

Self  Test /Check 

263 

IMU  Alignment /Perf  Test/Ops  Test 

17 

Uplink/Downlink 

32 

Display  Interf aces/Plnball/etc . 

56 

Executive/Waltllst /Service/ Centrals/etc . 

468 

F-8  DFBW  ERASABLE-MEMORY  USED 

LGC  ERASABLE-MEMORY  (8  EBANKS  AT  256) 


1596 

2048 
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Fig,  1,  F-8C  DFBW  Aircraft  and  Hardware 
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Fig.  2.  F-8  DFBW  Chronology 
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Fig.  3.  KSTART  Preparation 
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F“8  DFBW  Software  Development  Activity 


SIMULATOR  INPUT 


FIXED  MEMORY  SIMULATOR  OUTPUT 

FABRICATION 


Fig.  7.  Simulator  System  Schematic 


FLIGHT  TEST  EXPERIENCE  WITH  THE  F-8 


DIGITAL  FLY-BY-WIRE  SYSTEM 


Kenneth  J . Szalai 
NASA  Flight  Research  Center 

SUMMARY 


Flight  test  results  of  the  F-8  digital  fly-by-wire  (DFBW)  control  system  are 
presented  and  the  implications  for  application  to  active  control  technolo^  (ACT)  are 
discussed.  The  F-8  DFBW  system  has  several  of  the  attributes  of  proposed  ACT 
systems,  so  the  flight  test  experience  is  helpful  in  assessing  the  capabilities  of  those 
systems . Topics  of  discussion  include  the  predicted  and  actual  flight  performance 
of  the  control  system , assessments  of  aircraft  flying  qualities  and  other  piloting 
factors,  software  management  and  control,  and  operational  experience. 


INTRODUCTION 


In  May  1972  the  flight  testing  of  the  F-8  DFBW  aircraft  began.  This  aircraft, 
which  used  Apollo  guidance  and  navigation  system  hardware , was  the  first  to  rely 
on  a DFBW  system  for  primary  flight  control . The  design  and  development  of  the 
F-8  DFBW  control  system  are  described  in  references  1 to  3,  This  paper  presents 
the  major  flight  test  results  for  the  control  system.  A detailed  description  of  the 
system's  software  development  and  verification  is  given  in  reference  4,  and  the 
backup  control  actuation  systems  are  described  in  reference  5 . 

The  primary  objectives  of  the  flight  tests  were  to  evaluate  the  performance  of 
the  digital  flight  control  system  and  to  acquire  operating  experience  with  it  . The 
program  also  served  to  determine  whether  the  long-advertised  advantages  and 
capabilities  of  DFBW  control  systems  could  be  realized . Many  of  these  advantages , 
such  as  software  flexibility , system  reliability , and  computational  ability , make  a 
DFBW  system  a logical  candidate  for  active  control  technology  applications . The 
F-8  DFBW  control  system  had  characteristics  in  common  with  systems  proposed 
for  ACT  applications.  Specifically,  it  was  a highly  reliable,  full  authority  system 
that  was  committed  for  use  from  the  first  takeoff  and  landing.  An  analog  control 
system  was  the  only  backup  to  the  DFBW  system . The  mechanical  controls  of  the 
basic  F-8C  airplane  were  removed  before  the  first  flight . 


This  approach  parallels  that  taken  toward  the  development  of  an  active  control 
system , both  in  terms  of  the  importance  attributed  to  the  design  of  the  control 
system  and  the  reliability  and  management  of  hardware  and  software,  and  in  terms 
of  the  requirement  for  detailed  preflight  testing . This  paper  emphasizes  the  aspects 
of  the  flight  test  program  that  relate  to  the  broader  considerations  of  an  active 
control  system . 


SYMBOLS 
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G(s) 

G(w) 

G(z) 

K 


K 


r 


M 

Mg 


e 


n 


Z 


P 


digital  filter  coefficients 


general  s-plane  filter 
general  w -plane  filter 
general  digital  filter 
general  gain  constant 
C*  feedback  gain,  deg/g 

roll  rate  feedback  gain , deg/deg/sec 

pitch  rate  feedback  gain,  deg/deg/see 

yaw  rate  feedback  gain , deg/deg/see 

roll  acceleration  due  to  aileron  deflection , 

2 

deg/ sec  /deg 
Mach  number 

pitch  acceleration  due  to  elevon  deflection , 
2 

deg/ sec  /deg 

yaw  acceleration  due  to  rudder  deflection  , 
deg/sec  /deg 

acceleration  along  positive  Z-body  axis , g 
roll  rate , deg/  see 


200 


q 

r 

s 


9 

'I' 

(O 

Subscripts; 

d 

n 

n-1 

P 

sp 


pitch  rate,  deg/ sec 
yaw  rate  , deg/ sec 
Laplace  transform  variable 
sample  period , sec  \ 
velocity,  KIAS 
crossover  velocity , m/sec 

sampled-data  system  frequency  domain  variable 

sampled-data  domain  transform  variable 

incremental  change 

general  surface  command , deg 

pilot  roll  stick  deflection,  cm 

horizontal  stabilizer  deflectioh  , deg 

damping  ratio 

pitch  attitude , deg 

effective  roll  mode  time  constant , sec 

roll  attitude  , deg 
heading  angle,  deg 
natural  frequency , Hz 

Dutch  roll  mode 
current  sample 
last  sample 
pilot 

longitudinal  short  period  mode 
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steady  state 


ss 

Z component  along  aircraft  Z-body  axis  in  positive  (down) 

direction 

C)  derived  quantity  ( ) 

ABBREVIATIONS 


ACT 

active  control  technology 

A/D 

analog  to  digital 

CAS 

command  augmentation  system 

D/A 

digital  to  analog 

DFBW 

digital  fly-by-wire 

DSKY 

display  and  keyboard 

KIAS 

knots  indicated  airspeed 

PCM 

pulse  code  modulation 

PIG 

pilot-induced  oscillation 

SAS 

stability  augmentation  system 

CONDUCT  OF  FLIGHT  TEST  PROGRAM 


Figure  1 illustrates  the  nature  and  sequence  of  the  phases  of  the  flight  test 
program . The  first  three  flights  were  made  by  using  the  proportional  control , or 
direct , digital  mode . The  fourth  flight  culminated  in  a landing  during  which  three- 
axis  DFBW  stability  augmentation  was  used  . The  evaluation  of  the  DFBW  control 
system  progressed  rapidly  from  then  on , and  by  the  eighth  flight  all  modes  had 
been  flown . The  airplane  was  then  evaluated  in  a variety  of  tasks , including 
ground-controlled  approaches , gunsight  tracking , mild  aerobatics  , and  formation 
flight . The  latter  portion  of  the  flight  program  concentrated  on  flying  qualities 
assessments  by  additional  pilots  and  on  an  evaluation  of  a minimum -displacement 
side  stick  that  operated  through  the  backup  control  system  only  (ref.  5)  . In  total, 

58  hours  were  accumulated  by  six  pilots  during  42  flights  . 

The  F-8  DFBW  system  was  flight  tested  within  the  flight  envelope  shown  in 
figure  2 . Most  of  the  closed-loop  evaluations  were  made  at  speeds  between  250  knots 
indicated  airspeed  (KIAS)  and  400  KIAS  and  altitudes  from  6000  meters  to 
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10,700  meters.  Tests  at  low  speeds  (below  200  KIAS)  were  made  with  the  variable- 
incidence  wing  of  the  F-8C  airplane  in  the  up  position . Pilot  ratings  were  given  in 
accordance  with  the  Cooper-Harper  scale  (ref  . 6) . 

All  flights  were  conducted  during  the  daytime  under  VFR  conditions . They 
averaged  80  minutes  in  duration.  Each  flight  was  monitored  in  a control  room  in 
which  36  airplane  parameters  were  displayed.  In  addition,  duplicates  of  the  pilot’s 
mode  panel  and  servo  status  panel  showed  the  state  of  the  fly-by-wire  control  sys- 
tem. All  parameters  were  telemetered  from  the  aircraft’s  pulse  code  modulation 
(PCM)  data  acquisition  system . 


CONTROL  SYSTEM  PERFORMANCE 


The  digital  flight  control  system  consisted  of  pilot-selectable  modes  in  each 
axis . The  mode  panel  layout  is  described  in  reference  3 . The  available  modes  are 
shown  by  axis  in  the  table  below; 


Axis 

Pitch 

Roll 

Yaw 

Direct 

Direct 

Direct 

Modes  available 

SAS 

SAS 

SAS 

CAS 

Test 

The  direct  mode  , which  had  no  augmentation,  and  a stability  augmentation  sys- 
tem (SAS)  mode  were  provided  in  each  axis . A command  augmentation  system  (CAS) 
mode  was  also  available  in  the  pitch  axis . The  roll  test  mode  was  used  to  facilitate 
comparisons  between  various  SAS  mode  configurations . Block  diagrams  of  the 
digital  control  modes  are  shown  in  figures  3(a)  to  3(c)  . 


Direct  Mode 

The  direct  mode  provided  proportional  control  with  no  augmentation.  Figure  3(a) 
shows  the  direct  mode  mechanization,  which  was  similar  in  all  axes.  Analog-to- 
digital  (A/D)  quantization  of  the  stick  outputs , effective  quantization  on  trim  due  to 
sample  rate,  and  digital-to-analog  (D/A)  output  quantization  are  aspects  of  digital 
flight  control  that  were  apparent  in  this  mode . Linear  and  nonlinear  stick  shaping 
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were  used  during  the  flight  program.  In  the  pitch  axis,  linear  and  parabolic  shaping 
were  used  (fig . 4)  . The  Apollo  A/D  interface  allowed  a maximum  of  45  quantization 
levels  for  full  stick  or  pedal  deflection  in  one  direction . The  Apollo  computer  D/ A 
converter  output  quantization,  which  had  ±384  levels,  was  approximately  an  order 
of  magnitude  finer  than  the  stick  A/D  converter . The  linear  gearing  mechanization 
resulted  in  a quantization  level  of  0.59°  of  horizontal  stabilizer  deflection  when  full 
pitch  control  authority  was  retained . During  early  flights , various  linear  gearing 
gains  were  evaluated . Table  1 summarizes  the  pitch  quantization  effects  found  with 
linear  gearing.  The  threshold  of  quantization  detection  appeared  to  be  from  0.15g  to 
0.  2g  and  1.2  degrees  per  second  to  1.5  degrees  per  second  of  peak  pitch  rate  . 

Figure  5 shows  an  example  of  the  thumping  that  the  pilot  detected  at  365  KIAS  as 
he  attempted  to  increase  pitch  rate  smoothly  . This  small  airplane  excitation  was 
characteristic  of  the  quantization  effect  in  the  pitch  and  roll  axes  resulting  from 
control  surface  actuator  response  to  staircase  commands. 

The  parabolic  stick  shaping  resulted  in  a nonlinear  quantization . The  step  size 
is  shown  in  table  2 . This  shaping  greatly  improved  the  fine  pitch  control  of  the 
airplane , while  retaining  nearly  full  stabilizer  authority  . With  this  mechanization , 
pilots  reported  that  quantization  was  not  apparent  at  speeds  up  to  approximately 
400  KIAS . In  the  roll  axis , stick  quantization  had  to  be  reduced  by  changing  the 
linear  gearing  about  the  center  stick  position.  The  initial  value  of  1.04°  of  total 
aileron  command  was  changed  to  0.36°.  This  reduced  the  minimum  commanded 
roll  rate  from  8.32  degrees  per  second  to  2.90  degrees  per  second  at  250  KIAS  and 
yielded  acceptable  roll  control  around  trim . The  only  noticeable  effect  of  quantiza- 
tion in  the  yaw  axis  was  in  random  1-bit  commands  that  were  observed  at  400  KIAS . 
Lateral  acceleration  peaks  of  0.03g  due  to  1-bit  or  0.38°  rudder  surface  commands 
were  observed . This  problem  was  corrected  by  writing  software  in  erasable  memory 
to  allow  a 1-bit  deadband  in  the  rudder  pedal  command . No  other  rudder  pedal 
quantization  effects  were  seen . 

It  should  be  noted  that  the  ±45  quantization  steps  available  represented  less  than 
a 6-bit  A/D  conversion.  A 12-bit  (11  bits  plus  sign)  A/D  capability  is  available 
today.  This  yields  a resolution  nearly  50  times  as  fine  as  that  in  the  F-8  DFBW 
system.  At  the  most  sensitive  F-8C  flight  condition,  which  was  Mach  0.86  at  sea 
level,  a 12-bit  A/D  interface  would  have  allowed  digital  commands  as  small  as 
O.OOlg,  assuming  linear  gearing  and  full  surface  authority  . Therefore  it  is  safe  to 
assume  that  the  quantization  effects  of  a modern  A/D  interface  would  be  negligible 
and  undetectable  by  the  pilot  . 

Quantization  of  pilot  trim  inputs  due  to  sample  rate  also  became  apparent  in  the 
flight  program.  In  the  F-8  DFBW  mechanization,  trim  command  discretes  were 
sampled  every  90  milliseconds.  Based  on  the  pitch  trim  rate  value  of  1.25  degrees 
per  second,  the  minimum  software  command  was  0.11°.  This  command  is  nearly 
twice  as  coarse  as  the  D/A  converter  quantization  steps  of  0.069°  for  the  horizontal 
stabilizer . This  effective  trim  quantization  was  a factor  in  making  precise  trim  of  the 
F-8  DFBW  aircraft  difficult  at  a target  speed  and  altitude. 

The  pitch  trim  discrete  inputs  should  have  been  sampled  at  the  major  cycle 
sample  period  of  30  milliseconds , which  would  have  resulted  in  a trim  quantization  of 
0.0375°.  This  would  have  taken  full  advantage  of  the  output  D/A  quantization.  This 
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points  out  the  need  to  sample  beep  trim  discrete  inputs  at  a high  enough  rate  to 
yield  acceptable  output  quantization . In  some  cases , trim  discretes  may  have  to  be 
sampled  at  rates  higher  than  the  major  cycle  sample  rate  , if  fine  trim  resolution  is 
required . 


Stability  Augmentation  System  Mode 

The  nominal  SAS  configurations  flown  are  shown  in  figure  3 (b) . Body  axis 
rate  was  estimated  by  filtering  the  transformed  inertial  attitude  from  the  Apollo 
inertial  platform . Compensation  filtering  and  gain  were  placed  in  the  feedback 
path . There  was  an  aileron-to-rudder  interconnect  in  the  yaw  SAS  mode  only . 

The  stick  and  trim  processing  were  identical  to  those  in  the  direct  mode . A rate 
reasonability  check  was  applied  to  the  final  command , and  an  automatic  transfer  to 
the  direct  mode  resulted  if  the  reasonability  threshold  was  exceeded . 

The  digital  SAS  modes  operated  as  expected . This  is  important  from  the  point 
of  view  of  the  sampled-data  design  process.  The  acceptance  of  digital  control 
systems  depends  in  large  part  on  the  ability  to  predict  system  performance 
accurately . 

The  digital  SAS  loops  were  designed  by  using  sampled-data  analysis  methods , 
especially  the  z-plane  root  locus  method.  The  linear  system  model  used  in  the 
pitch  axis  is  shown  in  figure  6 . An  ideal  pitch  rate  signal  was  assumed . At  first , 
the  rate  estimation  filter  that  acted  on  pitch  attitude  was  used  in  the  model , but  the 
resulting  pitch  rate  signal  was  found  to  be  nearly  identical  to  that  for  the  ideal 
case  at  the  F-8C  short  period  frequencies  . Neither  the  highly  nonlinear  A/D 
conversion  of  gimbal  angles  nor  the  axis  transformation  steps  were  modeled.  Four 
symmetrical  bending  modes  were  included  in  the  analysis . 

The  z-plane  root  locus  for  the  pitch  SAS  mode  without  lead-lag  compensation  is 
shown  in  figure  7 (a)  . A lead-lag  filter  was  designed  to  improve  the  performance 
of  the  pitch  rate  loop  in  increasing  the  short  period  damping  ratio . A w -plane 
frequency  response  was  used  to  select  the  compensation  root  locations.  The  w-plane 
compensation. 


G(w) 


w/0.1  + 1 

w^/0.16  + w/0.286  + 1 


was  transformed  to  the  z-plane  by  w = 


z - 1 
z + 1 


and  yielded  a discrete  filter , 


G(z) 


= 023(1  + z~^)(l  - 0.818Z 

1.0  - 0.976z"^  + 0.349z'^ 


The  root  locus  for  the  compensated  system  is  shown  in  figure  7 (b)  . Higher  short 
period  damping  ratios  were  achieved  by  using  the  lead-lag  filter , as  one  would 
expect  in  a continuous  system . A comparison  between  the  predicted  effects  of  the 


205 


compensation  filter  and  those  measured  in  flight  is  shown  in  figure  8 , where  the 
increment  in  short  period  damping  ratio  is  shown  for  three  flight  conditions . The 
sampled -data  system  prediction  is  good . 

The  improvement  in  airplane  response  with  the  pitch  SAS  is  evident  in  the 
flight  time  histories  in  figure  9.  Figures  10(a)  to  10(c)  show  a comparison  of 
predicted  with  measured  damping  in  the  three  airplane  axes . Agreement  is  good 
for  the  longitudinal  short  period  (fig.  10(a))  and  Dutch  roll  (fig.  10(b))  modes. 

At  low  gains  , rate  estimation  quantization  and  actuator  friction  restricted  surface 
motion  at  the  angular  rates  tested,  and,  as  a result,  the  SAS  loop  was  less  effective. 

The  flight  peiyformance  of  the  digital  roll  SAS  mode  is  illustrated  in  figure  10(c) . 
Since  the  roll  rate  response  that  resulted  from  a step  lateral  stick  command  was 
contaminated  slightly  by  the  Dutch  roll , an  effective  roll  mode  time  constant 
corresponding  to  the  time  between  the  initial  roll  rate  response  and  the  time  when 
63  percent  of  steady  state  was  achieved  was  used . Yaw  SAS  was  engaged  on  all 
runs  to  reduce  the  Dutch  roll  contamination.  The  predicted  trend,  which  was  for 
decreasing  roll  mode  time  constant  with  increasing  roll  SAS  gain,  is  clear  , although 
a bias  of  approximately  Qj.,  05  second  is  apparent . One  factor  that  contributed  to 
this  bias  was  the  nonideAl  pilot  step  input , which  resembled  a rapid  ramp . This 
resulted  in  a slightly  higher  than  predicted  effective  time  constant  , since  the 
predicted  value  was  ba^ed  on  a perfect  step  input . 

To  further  evaluate  the  sampled-data  analysis  method,  the  pitch  rate  feedback 
gain  was  increased  in  flight  until  the  compensation  root  approached  neutral  stability. 
Figure  11  shows  the  z-plane  root  locus  prediction  of  the  neutral  stability  point  to  be 
in  good  agreement  with  the  flight-measured  results . 

The  SAS  modes  also  operated  well  at  low  speeds . Pitch  SAS  results  are  shown 
in  figure  12(a) . , A washout  filter  was  designed  for  low  speed  operation  in  the 
s-plane  as  / 


G(s)=^ 

/ : ' 

The  discrete  washout  filter  formed  by  using  the  bilinear  transf<?(rmation  for  real 
roots  was  / 

^ 0.98522(1  - z”S 

G(z)  = — — i -j-d. 

1 - 0.9704Z  ^ 


The  results  of  the  washout  filter  addition  to  the  feedback  loop  on  aircraft  response 
was  as  expected  (fig.  12(b)) . The  highest  loop  gains  used  in  flight  were 


further  observation  is  appropriate . The  Apollo  inertial  platform  was  designed  for 
precise  navigation . It  had  an  A/D  interface , the  coupling  data  unit , that  was  not 
designed  to  facilitate  rate  estimation . Even  so , the  derived  body  rate  provided  a 
signal  that  could  be  used  satisfactorily  for  the  F-8  DFBW  damper  modes. 
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Command  Augmentation  System  Mode 

The  pitch  CAS  mode  block  diagram  is  shown  in  figure  3 (c) . Derived  normal 
acceleration  is  blended  with  derived  pitch  rate  to  form  the  feedback  signal , C* 

(ref.  7) . A forward  loop  integrator  and  bypass  path  provided  zero  steady  state 
error  and  resulted  in  neutral  aircraft  speed  stability . The  cos  9 correction  term 
eliminated  acceleration  feedback  in  a steady  climb  or  descent  . The  pilot  stick  and 
trim  interface  with  this  mode  was  the  same  as  in  the  direct  and  SAS  modes . 

As  was  the  case  in  the  pitch  SAS  mode , the  performance  of  the  digital  CAS  mode 
was  essentially  as  predicted  by  linear  sampled-data  systems  analysis.  However, 
gain  values  selected  for  the  C*  feedback  gain  during  the  preliminary  design  could 
not  be  used  in  flight  . The  reasons  for  this  are  traceable  to  the  noise  problems 
associated  with  using  rates  and  accelerations  derived  from  the  Apollo  inertial 
measurement  unit  and  interface  hardware  . These  problems  are  not  inherent  in  a 
digital  mechanization.  For  acceptable  noise  levels  at  the  horizontal  stabilizer, 
the  C*  feedback  gain  was  too  low  for  optimum  response . The  flight  performance 
of  the  CAS  mode  was  reasonable  at  low  speeds,  however.  Figures  13(a)  and  13(b) 
compare  the  F-8  DFBW  C*  response  in  the  direct  and  CAS  modes  at  180  KIAS  and 
250  KIAS , respectively.  These  responses,  normalized  to  the  final  value,  are  shown 
with  respect  to  the  C*  power  approach  and  cruise  djesign  envelopes , respectively . 
The  improvement  in  airplane  response  is  substantial  . The  250-KIAS  response 
illustrates  the  problem  encountered  in  CAS  with  insufficient  loop  gain . The  short 
period  response  was  satisfactory , but  the  aircraft  exhibited  drift  in  the  3-  to 
8-second  time  period  that  was  actually  the  first-order  mode  resulting  from  the 
forward  loop  integrator.  This  effect  was  apparent  to  the  pilots. 

The  CAS  mode  provided  the  expected  neutral  speed  stability.  Figures  14(a) 
and  14(b)  show  the  phugoid  response  of  the  F-8  DFBW  aircraft  in  the  direct  and 
CAS  modes,  respectively.  The  aircraft,  trimmed  at  180  KIAS,  was  slowed  approxi- 
mately 10  KIAS , where  the  stick  was  again  centered.  The  CAS  mode  held  zero  pitch 
rate  while  the  aircraft  slowed  to  a new  steady  state  speed  of  approximately  138  KIAS . 
Normal  acceleration  (not  shown)  remained  constant  at  nearly  Ig  during  the  maneuver, 
while  angle  of  attack  (not  shown) , which  started  at  3.5®,  stabilized  at  10®. 

The  effectiveness  of  the  CAS  mode  in  suppressing  transient  effects  is  shown  in 
figure  15,  where  the  response  of  the  F-8C  airplane  is  compared  in  the  direct  and 
CAS  modes  during  a wing  transition  (wing  incidence  changes  from  -1®  to  7®) . 

Both  responses  were  without  pilot  inputs . 

Although  the  performance  of  the  CAS  mode  was  degraded  by  the  limitations  of 
the  Apollo  hardware,  the  control  system  design  was  relatively  straightforward,  and 
flight  results  again  matched  predictions  quite  closely . 


Implications  of  Digital  Fly-By -Wire  Design  for  Active  Control  Systems 

The  flight  verification  of  the  F-8  DFBW  control  system  design  was  encouraging 
from  an  active  control  technology  standpoint.  First,  the  body  of  continuous 
control  system  design  experience  is  largely  applicable , In  fact , if  there  is  a 
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reasonable  separation  between  the  half  sample  frequency  and  modes  of  interest,  the 
design  can  be  accomplished  in  the  continuous  domain  and  then  exactly  transformed 
to  the  discrete  domain  by  using  the  bilinear  transform.  Furthermore,  direct  z-plane 
design  is  also  possible . The  most  serious  difficulty  about  using  the  latter  approach 
is  lack  of  experience  with  direct  digital  design . 

The  entire  F-8  DFBW  three-axis  digital  flight  control  system  problem  could  be 
solved  by  the  Apollo  computer  in  less  than  a 30-millisecond  major  cycle  time  period. 
The  capabilities  of  a current  high  performance  computer  and  those  of  the  Apollo 
computer  are: 


Apollo  computer  Current  computer 

Memory  cycle  time , jisec  11.7  1.0 

Add  time , psec  23.4  2.5 

Multiply  time , psec  46 .8  6.0 

The  table  shows  that  a state-of-the-art  computer  can  be  expected  to  be  an  order  of 
magnitude  faster  than  the  Apollo  computer.  This  suggests  a sample  rate  or  job 
capacity  increase  of  the  same  magnitude . Although  computer  sizing  must  await  a 
specific  ACT  configuration,  the  capability  of  today's  computers  would  appear  to  be 
more  than  adequate  for  the  control  system  tasks  envisioned  . 


PILOTING  FACTORS 


Considered  in  conjunction  with  the  control  system  performance  reported  in  the 
previous  section , the  handling  qualities  results  confirmed  the  feasibility  and 
utility  of  a digital  fly-by-wire  control  system . 


Handling  Qualities  Summary 

The  flying  qualities  of  the  F-8  DFBW  were  evaluated  by  the  pilots  in  a variety  of 
tasks,  including  simulated  instrument  cruise,  large  or  abrupt  maneuvers,  ground- 
controlled  approaches,  gunsight  tracking,  and  close  formation  flight  (ref.  8). 

Figure  16(a)  summarizes  the  longitudinal  handling  qualities  results  for  small 
instrument  maneuvers,  and  figure  16(b)  summarizes  the  results  for  large  maneuvers. 
The  piloting  tasks  and  the  comment  guide  used  for  these  evaluations  are  given  in 
the  appendix.  In  figure  16(a)  the  comments  and  ratings  are  typical  of  the  findings 
of  pilots  at  low-to-moderate  cruise  speeds  (less  than  350  KIAS) . For  large  maneuvers 
the  pilot  rating  improvement  with  control  system  sophistication  was  evident . Pilot 
acceptance  of  the  SAS  and  CAS  modes  was  expected  on  the  basis  of  the  control 
system  and  vehicle  response  characteristics  reported  in  the  previous  section.  Some 
pilots  did  report  a long  period  overshooting  tendency  in  the  CAS  mode  for  certain 
maneuvers  where  steady  state  pitch  rates  had  to  be  arrested . This  correlated  with 
the  first-order  integrator  mode  present  in  the  CAS  step  response . 
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Figure  17  is  characteristic  of  the  improvement  in  pitch  control  with  digital  SAS 
as  seen  by  the  pilots  in  a wind-up  turn.  In  the  direct  mode,  the  F-8C  airplane 
displays  its  undesirable  short  period  damping.  The  same  maneuver  could  be 
performed  easily  and  precisely  in  the  pitch  SAS  mode. 

Ground- controlled  approaches  were  flown  down  to  approximately  60  meters 
under  simulated  instrument  flight  conditions  in  the  various  digital  modes . Fig- 
ures 18  (a)  and  18  G?)  show  typical  pilot  comments  and  ratings  in  the  lateral- 
directional  and  longitudinal  axes  . The  pilot  ratings  reflect  the  improvement  in 
Dutch  roll  damping  provided  by  the  yaw  SAS  mode.  In  figure  18(b)  pilot  A objected 
to  a slight  long-term  overshooting  tendency  in  the  CAS  mode . 

The  tracking  performance  of  the  F-8C  airplane  with  the  digital  control  system 
was  degraded  by  stick  quantization  problems  in  both  the  pitch  and  roll  axes  . The 
parabolic  pitch  stick  shaping  resulted  in  unacceptable  quantization  steps  at  large 
aft  stick  positions  (table  2)  . This  degraded  the  pitch  control  of  the  airplane  so 
much  that  even  augmentation  did  not  significantly  improve  the  tracking  performance. 
Some  improvement  with  roll  and  yaw  SAS  was  evident  in  a 2g  gunsight  tracking 
maneuver , as  the  time  histories  in  figure  19  and  the  associated  pilot  comments  and 
ratings  in  figure  20  show  . The  augmented  time  histories  in  figure  19  correspond  to 
ayaw  SAS  gain,  K^,  of  0.4  deg/deg/ sec . 

Close  formation  flight  revealed  deficiencies  in  the  flying  qualities  that  were 
often  not  apparent  in  maneuvers  where  the  pilot  was  not  required  to  be  "in  the  loop" 
as  tightly . The  improvement  shown  in  figure  21  of  the  longitudinal  flying  qualities 
with  digital  augmentation  is  typical . Pilot  comments  reflected  the  decreased  work- 
load evident  in  the  time  history.  Barrel  rolls,  aileron  rolls,  and  wingovers  were 
performed  in  all  control  modes . Pilots  noted  little  difference  in  their  ability  to 
perform  these  maneuvers  between  the  direct  and  augmented  modes , perhaps  because 
these  maneuvers  tended  to  be  more  open  loop  in  nature. 

Except  in  maneuvers  where  the  coarse  stick  quantization  problem  was  over- 
riding , as  in  the  gunsight  tracking  maneuver , the  DFBW  control  system  markedly 
improved  the  flying  qualities  of  the  unaugmented  F-8C  aircraft  . Because  of  the 
control  system  performance  described  in  the  previous  section,  this  was  not 
unexpected . One  pilot  who  flew  P-8C  airplanes  regularly  found  the  F-8  DFBW 
vehicle  superior  even  to  a standard  F-8C  airplane  with  normal  augmentation.  He 
noted  in  particular  the  lack  of  the  usual  mechanical  control  slop . 

The  results  of  the  flying  qualities  evaluations , coupled  with  the  control  system 
performance  previously  described , indicate  that  a DFBW  control  system  can  perform 
as  well  as  or  better  than  a conventional  control  system . The  only  serious  problems 
encountered  were  due  to  the  limitations  of  the  Apollo  system  hardware,  which 
would  not  be  factors  in  a current  design . 
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Pilot  Interface  With  the  Digital-Fly -by-Wire  System 


The  F-8  DFBW  system  was  designed  to  permit  a simple,  yet  flexible,  interface 
with  the  pilot.  The  normal  astronaut  interface  with  the  Apollo  guidance  and 
navigation  system  was  a display  and  keyboard  device  (DSKY)  that  allowed  the 
operator  to  display  memory  contents , load  erasable  memory , or  initiate  special 
programs . The  versatility  of  this  interface  was  important  to  the  design  and  test 
engineers  during  the  development  and  flight  test  program , but  it  was  not  made 
available  to  the  pilot  because  of  its  complexity  for  a single  place  aircraft . The 
pilot’s  only  interface  with  the  digital  computer  was  through  a mode  and  gain  panel, 
which  is  described  in  reference  3 . The  pilot’s  gain  switch  mechanization  in  software 
contributed  to  the  rapid , safe  flight  checkout  of  the  digital  flight  control  system . 
Table  3 lists  the  different  digital  control  system  parameters  that  were  tied  to  the 
gain  switches  during  the  flight  test  program . In  all , 105  parameters  could  be 
connected  via  software  to  the  three  gain  switches. 

With  this  gain  mechanization , different  control  system  parameters  could  rapidly 
be  selected  and  optimized  during  the  research  program . More  important , the  gain 
switches  allowed  the  designer  to  make  use  of  the  pilot’s  capabilities . Nominal 
values  of  critical  gains  that  were  established  during  the  simulation  phase  were 
placed  on  the  gain  switches  along  with  larger  and  smaller  values.  The  pilot  could 
change  the  gain  values  at  any  time . For  example , one  of  the  gain  switches  was  for 
pitch  gearing . During  the  first  flight , when  the  effects  of  the  pitch  quantization 
and  sensitivity  had  not  yet  been  established , the  pilot  took  off  in  the  nominal  gain 
position.  By  13  minutes  after  takeoff  at  300  KIAS , he  had  reduced  the  gearing 
10  percent  because  of  pitch  control  sensitivity . Before  landing  he  evaluated  three 
gain  positions , finally  selecting  the  nominal  gain  value  2 1/2  minutes  before  touch- 
down. Apart  from  its  research  value,  this  type  of  gain  selection  and  evaluation 
gave  the  pilot  an  important  degree  of  freedom . Switch  arrangements  like  this  are 
not  unique  to  digital  flight  control  systems , but  the  ability  to  designate  such  a large 
number  (105)  of  parameters  for  this  use  with  virtually  no  hardware  impact  is 
unique  to  a digital  system . 

This  kind  of  flexibility  can  be  carried  in  a digital  computer  with  only  a small 
increase  in  software  complexity . This  mechanization  approach  would  also  be 
advantageous  in  an  active  control  system  design,  because  the  F-8  DFBW  experience 
showed  that  the  pilot  could  rapidly  and  safely  assess  open-  and  closed-loop  gain 
parameter  variations  about  the  nominal  design  point  during  flight  . 

Flight  experience  also  showed  the  multimode  digital  flight  control  system  to  be 
safe  and  valuable  for  both  research  and  proof  testing  phases  of  the  flight  program . 
The  low  mode  of  control  in  the  primary  digital  system  (direct)  provided  a fallback 
position  for  both  the  pilot  and  the  system . Since  the  direct  and  augmented  modes 
were  fully  synchronized , they  could  be  switched  manually  or  automatically  under 
any  dynamic  conditions  with  a minimum  and  safe  aircraft  response  transient . The 
pilots  took  advantage  of  this  multimode  mechanization  to  diagnose  the  cause  of  flying 
qualities  deficiencies  by  comparing  airplane  response  in  each  mode  . 

Like  the  gain  switch  arrangement , the  multimode  mechanization  makes  use  of 
the  online  monitoring  capabilities  of  the  pilot  . It  too  is  a good  candidate  for  active 
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control  mechanization,  especially  for  the  first  few  flights.  One  problem  was 
encountered  with  this  approach  . Mode  changes  could  occur  without  being  commanded 
by  the  pilot  due , for  example , to  a reasonability  test . The  mode  panel  display  light 
configuration  would  change , but  this  was  not  easily  detected  by  the  pilot . A master 
caution  and  annunciator  warning  of  any  uncommanded  mode  change  should  have 
been  incorporated . 

In  summary , software  flexibility  allowed  the  test  pilot  to  use  his  real-time 
diagnostic  capability  and  to  make  control  system  alterations . The  alterations  could 
be  made  with  almost  no  hardware  impact  and  with  minimum  additional  software  com- 
plexity . These  concepts  are  applicable  to  early  flight  testing  of  full  time  active 
control  systems . 


MANAGEMENT  OF  FLIGHT  SOFTWARE 


The  flexibility  and  versatility  of  digital  flight  control  system  software  carries 
with  it  the  need  for  software  management  and  control . Perhaps  no  other  area  of 
digital  fly-by-wire  control  raises  as  many  questions  and  doubts  as  software 
reliability . The  concern  centers  on  whether  it  is  possible  to  achieve  reliable  man- 
rated flight  control  software  at  a reasonable  cost  and  whether  software  flexibility  is 
compatible  with  software  reliability  in  a practical  application . The  F-8  DFBW 
experience  indicates  that  both  questions  can  be  answered  yes . 


Two  aspects  of  the  F-8  DFBW  flight  test  program  are  of  significance  to  full 
authority,  man-rated  digital  flight  control  software.  First,  not  a single  software 
programing  error  was  discovered  during  the  flight  test  program . Much  of  the 
credit  for  this  is  due  to  the  thorough  verification  procedures  and  facilities  developed 
for  the  Apollo  software,  which  were  also  used  during  the  F-8  DFBW  program, 
although  on  a smaller  scale.  The  procedures  are  described  in  detail  in  reference  4. 
Secondly , not  a single  incorrect  erasable  memory  constant  propagated  to  a flight 
tape  that  was  used  to  load  the  Apollo  computer . These  results  are  significant 
because  an  active  control  system  must  achieve  the  same  level  of  reliability  as  the 
basic  airframe.  The  software,  in  turn,  is  central  to  the  active  control  system's 
reliability , because  even  though  an  active  control  system  would  have  redundant 
digital  channels , the  software  would  be  common  to  all , as  it  was  in  the  F-8  DFBW 
system.  For  this  reason,  it  is  worthwhile  to  examine  the  software  management 
procedures  used  in  the  F-8  DFBW  program. 

Figure  22(a)  outlines  the  procedures  established  to  control  software  programing 
changes  during  the  flight  program.  These  procedures  were  used  three  times  after 
the  hardwired  memory  was  manufactured  and  before  the  first  flight . The  three 
special  purpose  programs  written  into  the  erasable  memory  consisted  of  pitch  and 
roll  parabolic  stick  shaping,  yaw  pedal  deadband,  and  a special  failure  mode 
monitor . 

The  software  control  board  in  figure  22  (a)  consisted  of  representatives  from 
control  system  engineering,  project  management , operations,  and  the  pilots' 
office  . Step  7 in  figure  22(a)  consisted  not  only  of  checking  out  the  new  code  but 
rerunning  former  , documented  tests  on  related  code  to  insure  proper  program 
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interaction , if  any . Extensive  files  of  detailed  all-digital  simulation  runs  generated 
during  the  initial  verification  phase  were  kept  for  comparison  with  identical  runs 
with  the  modified  code . This  permitted  short  turnaround  time  for  hew  additions 
to  the  code . 

Figure  22(b)  shows  the  steps  taken  in  the  alteration  of  control  system  constants 
in  the  erasable  memory.  In  total,  394  erasable  memory  locations  had  to  be  loaded 
for  each  flight  . Table  4 gives  a breakdown  of  these  constants  . Sum  checks  and 
built-in  data  transmission  checks  in  the  Apollo  computer  made  it  possible  to  insure 
that  the  desired  octal  numbers  were  loaded  into  the  computer . 

Making  sure  that  the  168  control  system  values  loaded  were  those  actually 
desired  was  less  straightforward . A punched  tape  was  used  to  load  the  computer . 
During  the  flight  program  six  tapes  were  manufactured,  each  of  which  represented 
a different  flight  control  system  configuration . 

Because  the  Apollo  digital  computer  is  a fixed-point  machine,  there  were 
magnitude  restrictions  due  to  program  scaling  on  most  parameters.  A variety  of 
other  restrictions  combined  to  create  a formidable  set  of  rules  for  the  set  of  control 
system  constants. 

An  off-line  diagnostic  digital  program  (step  3 of  fig  . 22(b)) , which  ran  on  a 
data  processing  computer , was  developed  to  ease  the  burden  of  verifying  the 
correct  content  of  the  master  load  list  , which  was  kept  on  standard  punch  cards. 

One  task  performed  by  the  diagnostic  program  was  to  check  each  of  the  394  constants 
against  a previously  drawn  list  of  reasonable  values.  This  reasonability  list  was 
constructed  after  considerable  experience  was  gained  from  iron  bird  simulation , 
but  before  the  first  flight  tape  was  made . The  limits  were  set  to  encompass  the 
expected  or  allowable  operating  range  of  each  variable . Deviations  from  reason- 
ability  limits  were  flagged  by  the  program  as  major  errors  and  had  to  be  corrected 
or  signed  off  by  the  responsible  engineer . 

The  program  also  reconstructed  digital  filter  forms  from  their  coefficients  and 
computed  their  vital  characteristics , such  as  root  location , steady  state  gain , and 
absolute  root  magnitude  in  the  z-plane . This  was  helpful  in  the  case  of  digital 
filters,  the  characteristics  of  which  are  not  as  obvious  as  those  of  continuous 
filters . 

One  aspect  of  software  control  became  apparent  during  the  ground  testing  and 
simulation  of  various  control  system  gain  configurations . When  many  gain  changes 
had  been  made  and  the  precise  configuration  was  in  doubt , it  was  only  necessary 
to  dump  the  contents  of  erasable  memory  on  magnetic  tape  to  create  a complete 
description  of  any  given  configuration . This  capability  proved  to  be  extremely 
valuable  in  the  control  system  refinement  stage , and  it  is  unique  to  a digital 
mechanization . It  was  also  possible  to  revert  to  the  baseline  configuration  merely 
by  reloading  memory  with  the  baseline  punched  tape . This  required  approximately 
3 minutes  on  the  Apollo  computer . 

In  summary , the  F-8  DFBW  flight  experience  indicates  that  highly  reliable  flight 
software  can  be  generated  and  maintained , but  that  it  requires  thorough  control . 
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Because  the  F-8  DFBW  program  was  intended  for  research,  the  software  program 
was  made  more  flexible  than  would  be  necessary  for  a production  airplane.  Even 
with  this  flexibility , the  software  was  easily  managed  with  diagnostic  digital 
programs,  resulting  in  high  overall  system  reliability.  In  fact,  changes  were  made 
to  the  digital  system  more  confidently  than  they  were  to  the  airplane’s  analog 
systems  because  there  was  no  hardware  impact  . 

Partly  because  of  the  built-in  flexibility  of  the  control  system  mechanization , 
only  minor  changes  had  to  be  made  to  the  basic  program  during  the  flight  test 
program . More  program  changes  would  be  expected  in  a prototype  system  develop- 
ment, thus  increasing  the  need  for  strict  configuration  management  for  software. 

The  F-8  DFBW  flight  results  confirmed  that  a DFBW  control  system  could  be 
used  in  an  active  control  application  from  the  standpoint  of  software  reliability  and 
system  flexibility . 


OPERATIONAL  FACTORS 


Reasonability  Checks 

The  software  reasonability  checks  used  in  all  augmented  modes  are  surface 
command  rate  checks  made  over  one  sample  period  (30  milliseconds)  . Exceeding 
the  threshold  value  in  any  axis  resulted  in  an  automatic  downmode  to  the  direct 
mode  in  that  axis.  The  threshold  values  per  sample  period  that  were  found  to  be 
usable  in  flight  were  4.5°  in  pitch,  13.0°  in  roll,  and  8.0°  in  yaw.  These  were  the 
smallest  values  that  allowed  nearly  any  pilot  input . Ten  downmodes  occurred  in 
flight.  All  except  four  were  directly  related  to  sharp  pilot  step  inputs  that  were 
made  for  test  ptxrposes.  The  other  four  were  due  to  noise  peaks  that  resulted  from 
the  angular  rate  derivation.  At  least  one  of  these  occurred  in  each  axis. 

The  reasonability  check  was  designed  to  detect  abrupt  command  changes  due  to 
sensor  failures  or  major  software  faults . Experience  with  the  F-8  DFBW  system 
indicated  that  the  threshold  rate  limit  could  be  reduced  by  at  least  50  percent  in 
all  axes  for  an  operational  fighter . If  unreasonable  commands  were  allowed  to 
exist  for  100  milliseconds  (approximately  three  sample  periods)  , nuisance  down- 
modes  would  be  eliminated  without  sacrificing  protection . 


Digital  System  Reliability 

The  F-8  DFBW  digital  eontrol  system  utilized  a single  highly  reliable  digital 
computer . This  configuration  would  probably  not  be  used  in  an  active  control 
system . However , the  reliability  requirements  of  the  F-8  digital  system  are  repre- 
sentative of  the  requirements  of  an  ACT  application . First , no  single  failure  was 
permitted  that  would  have  resulted  in  the  generation  of  a hazardous  control  surface 
command . Second , any  serious  failure  within  the  digital  system  had  to  be  detected . 
In  the  F-8  DFBW  airplane , the  failure  warning  signals  were  used  to  transfer  control 
to  the  analog  backup  control  system . In  a redundant  digital  control  system , 
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operation  would  continue  on  the  remaining  good  digital  channels  after  a component 
failure.  F-8  DFBW  reliability  experience  is  nevertheless  applicable  to  active 
control  technology  in  terms  of  failure  detection  and  also  in  terms  of  the  features 
of  the  digital  mechanization  that  led  to  a high  level  of  confidence  in  this  system  . 

No  hardware  failures  occurred  in  the  primary  digital  flight  control  system  on 
any  flight . This  is  not  surprising  in  view  of  the  demonstrated  in-service  reli- 
ability of  the  Apollo  guidance  and  navigation  equipment . The  diserepancies  noted 
in  the  DFBW  flight  system , excluding  the  actuators  and  their  drive  electronics , 
are  listed  in  table  5 . Three  component  failures  occurred  in  two  systems  during  the 
2500  hours  of  operation  (items  4,5,  and  10) . Item  4 would  have  had  no  impact  on 
normal  flight  operation , The  failure  monitor  in  item  5 was  added  to  the  system 
during  the  flight  program  to  protect  against  a potentially  hazardous  single-point 
failure  mode  in  the  Apollo  computer  output  interface  hardware , The  monitor  box 
failed  before  its  first  use  in  flight,  although  it  failed  in  the  proper  "safe”  mode 
(transfer  to  the  backup  control  system) . The  roll  stick  circuit  failure  (item  10) 
would  have  caused  a downmode  to  the  backup  control  system  in  flight , as  it  did 
on  the  ground.  There  were  no  unresolved  anomalies. 


Preflight  Procedures 


Two  preflight  test  procedures  were  used  for  the  digital  system . The  first  was 
a 1-hour  test  done  on  the  system  in  the  hangar  the  day  before  flight . Electrical 
and  hydraulic  power  were  external.  The  second  procedure  was  part  of  the  total 
aircraft  preflight  immediately  before  flight , with  engine- supplied  electrical  and 
hydraulic  power . The  elements  of  the  hangar  and  flight  line  preflight  tests  are 
listed  in  table  6 . Virtually  all  the  hangar  tests  except  the  specialized  inertial 
measurement  unit  checks  and  the  detailed  surface  deflection  measurements  were 
repeated.  Although  the  digital  system's  flight  line  preflight  was  not  optimized  in 
the  built-in  software , it  took  only  10  to  15  minutes . 

One  sensitive  preflight  test  was  the  computer  activity  check.  A program  in  the 
erasable  memory  was  used  to  measure  computer  duty  cycle  indirectly  , by  detecting 
idle  time  over  a several  second  interval . In  a given  configuration , the  duty  cycle 
was  consistent  within  a few  percent  over  several  time  intervals.  This  test  confirmed 
proper  software  operation  to  a high  level  of  confidence. 

During  the  investigation  of  the  anomalies  that  occurred  on  both  the  iron  bird 
and  the  F-8  DFBW  airplane , it  became  apparent  that  it  was  possible  to  determine 
the  health  of  the  digital  control  system  rapidly  and  confidently . The  state  of  the 
digital  control  system  could  be  determined  in  less  than  5 minutes  by  running  a 
self-test  and  by  monitoring  the  internal  control  system  parameters  on  the  DSKY  in 
the  flight  control  modes . The  monitor  feature  was  indispensable  during  the  flight 
test  program . With  half  a dozen  keystrokes , three  control  system  parameters  could 
be  displayed  in  engineering  units  and  in  decimal  format . The  display  was  updated 
every  second,  so  even  under  dynamic  conditions  the  display  was  intelligible.  This 
monitor  format  permitted  the  immediate  checkout  of  virtually  any  part  of  the  control 
system.  Any  future  digital  flight  control  system  should  incorporate  such  display 
software  capability . 
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The  ability  to  quickly  and  confidently  assure  proper  control  system  performance 
is  of  paramount  importance  to  active  control  systems . The  repeatability  of  the  test 
results  of  the  F-8  DFBW  program  inspired  enormous  confidence  in  the  operational 
readiness  of  the  system  before  flight . Even  personnel  not  thoroughly  familiar  with 
the  digital  control  system  were  able  to  perform  detailed  tests  of  the  system  because 
of  the  well-designed  display  and  monitor  software . The  component  failures  that 
did  occur  during  ground  operation  were  all  detected  by  the  system  itself. 


CONCLUDING  REMARKS 


The  F-8  digital  fly-by-wire  (DFBW)  flight  program  showed  the  feasibility  and 
advantages  of  DFBW  control  for  aircraft . Even  with  hardware  designed  a decade 
ago  for  space  applications , an  Apollo  computer  easily  handled  the  F-8  DFBW  flight 
control  computation  task.  This  demonstrated  the  inherent  flexibility  of  a digital 
system . 

The  following  conclusions  can  be  drawn  on  the  basis  of  the  F-8  DFBW  flight 
test  program . 

(1)  Existing  design  tools , such  as  the  w-plane  frequency  response  and  the 
z-plane  root  locus , are  suitable  for  the  synthesis  of  digital  flight  control . 

(2)  Flight  performance  of  the  digital  flight  control  system  verified  the  accuracy 
of  the  sampled-data  design  results  for  contemporary  command  and  stability  augmen- 
tation system  modes . 

(3)  Pilot  opinion  correlated  with  that  expected  on  the  basis  of  the  control  system 
performance. 

(4)  A modern  digital  control  system  design  would  display  no  quantization  effects 
noticeable  to  the  pilot  . 

(5)  The  flexibility  of  the  digital  control  system  permits  effective  use  of  the 
pilot  in  configuration  optimization  in  early  flight  test  stages . 

(6)  Man-rated  software  can  be  safely  managed  while  retaining  a high  degree  of 
flexibility . The  use  of  off-line  diagnostic  programs  greatly  reduced  the  engineering 
burden  of  software  management . 

(7)  Digital  system  integrity  can  be  rapidly  and  confidently  determined  in  pre- 
flight tests  by  using  flexible  and  extensive  engineering  interfaces . 

The  implications  of  these  results  for  an  active  control  application  can  be  broadly 
stated  as  follows: 

(1)  A DFBW  control  system  possesses  the  computational  ability  and  flexibility 
necessary  for  advanced  active  control  applications . Computer  hardware  advances 
are  leading  control  system  applications . 
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(2)  Reliable  software  can  be  produced  and  is  not  an  obstacle  to  an  active  control 
application . 

(3)  The  fault  detection  and  preflight  test  technology  necessary  for  digital 
control  systems  exists.  Full  realization  of  PFBW  potential  awaits  the  successful 
demonstration  of  reconfiguration  and  normal  operation  after  component  failures  in  a 
practical  redundant  system . 

There  was  no  flight  or  ground  experience  that  would  indicate  that  a DFBW 
system  could  not  be  used  in  an  active  control  technology  application . In  fact  , the 
F-8  DFBW  flight  program  achieved  in  practice  the  advantages  so  long  attributed  to 
a DFBW  control  system  and  confirmed  the  suitability  Of  digital  control  for  active 
control  technology  . 


APPENDIX 


PILOT  COMMENT  GUIDE  FOR  LONGITUDINAL  HANDLING  QUALITIES 


Instrument  Flight  Maneuvering 

(1)  Trim  the  aircraft  to  desired  speed  at  a zero  rate  of  climb 

(2)  Make  small  heading  changes  of  less  than  30° 

(3)  Make  air  traffic  control  altitude  changes 

(4)  Make  air  traffic  control  speed  changes 


Comment  on: 

(1)  The  ability  to  fine  trim  the  aircraft 

(2)  The  need  to  monitor  the  pitch  axis  during  lateral-directional  tasks 

(3)  The  ability  to  make  accurate  changes  in  attitude 

(4)  Stick  breakout  and  deadband  forces 

(5)  The  acceptability  of  these  aircraft  characteristics  for  fighter  aircraft 

(6)  Overall  longitudinal  pilot  rating 


Large  or  Abrupt  Maneuvers 

(1)  From  trimmed  flight,  quickly  establish  a 1.5g  to  2.5g  turn 

(2)  Recover  to  trimmed , level  flight 

(3)  Quickly  set  up  a constant  speed  high  performance  climb  by  selecting  a target 
pitch  attitude  and  throttle  setting 

(4)  Recover  to  trimmed  , level  flight  at  target  altitude 

(5)  Increase  speed  50  KIAS , and  retrim 


Comment  on: 

(1)  The  ability  to  control  attitude  and  g , Tendencies  to  overshoot  or  for  pilot- 
induced  oscillations 

(2)  The  ability  to  restore  the  aircraft  to  trimmed  flight 

(3)  Stick  breakout  and  deadband  forces 

(4)  The  lag  in  aircraft  response  to  stick  inputs 

(5)  Residual  small-amplitude  oscillations 

(6)  The  acceptability  of  these  characteristics  for  fighter  aircraft 

(7)  Overall  pilot  rating  for  the  large  or  abrupt  maneuvers 
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TABLE  1. -PITCH  STICK  QUANTIZATION  EFFECTS  WITH  LINEAR  GEARING 
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TABLE  2. -QUANTIZATION  MAGNITUDE  FOR  FULL  AUTHORITY 
PARABOLIC  PITCH  STICK  SHAPING 


Nominal  stick  position  . 

Quantization  size  . 

cm 

deg 

0 

0.1 

5 

0.3 

10 

6.7 

15 

1,2 

TABLE  3. -DIGITAL  CONTROL  SYSTEM  PARAMETERS 
TIED  TO  GAIN  SWITCHES 


Axis 

Mode 

Description 

Pitch 

Direct 

Stick  gearing 

Pitch 

SAS 

Pitch  rate  feedback  gain 

Pitch 

SAS 

Type  of  digital  filter 

Pitch 

CAS 

Forward  loop  integrator  gain 

Pitch 

CAS 

C*  feedback  gain 

Pitch 

CAS 

Pitch  rate  blending  gain 

Roll 

Direct 

Stick  gearing  — wing  down 

Roll 

Direct 

Stick  gearing  — wing  up 

Roll 

SAS 

Stick  gearing 

Roll 

SAS 

Nonlinear  stick  shaping 

Roll 

SAS 

Roll  rate  feedback  gain 

Yaw 

SAS 

Yaw  rate  feedback  gain 

Yaw 

SAS 

Interconnect  function  slope 

, Yaw 

SAS 

Interconnect  function  intercept 

TABLE  4. -ERASABLE  MEMORY  CONSTANTS  LOADED 
FOR  EACH  F-8  DFBW  FLIGHT 


Description 

Number 

Control  system  constants 

168 

Computer  downlink  identity  tags 

100 

Inertial  subsystem 

29 

Erasable  memory  prognfani 
(parabolic  stick  shaping) 

87 

Miscellaneous 

10 

Total:  394 

TABLE  5. -DIGITAL  SYSTEM  DISCREPANCIES  DURING  GROUND  OPERATION 


(a)  Discrepancies. 


Item 

Discrepancy 

Reason  for  discrepancy 

1 

Computer  restarts 

Procedural  error 

2 

Computer  time'-of-day  wrong 

Procedural  error 

3 

Inertial  measurement  unit  test 
result  out  of  specification 

Inertial  measurement  unit 
degradation  for  navigation 

Yaw  direct  light  cycling  on-off 

Failed  transistor  in  mode  panel 

Backup  control  system  down- 
mode for  rudder  inputs 

Failure  in  relay  in  external  fail 
monitor 

6 

Computer  locked  in  loop 

Procedural  error 

7 

Failure  of  preflight  test 

Damage  to  punched  tape 

8 

Aileron  offset 

Procedural  error 

9 

Roll  D/A  drift  during  backup 
control  system  self-test 

Truncation  during  repeated 
primary/backup  control 
system  moding 

®10 

Baekup  control  system  down- 
mode for  aileron  inputs 

Failed  resistor  in  external  stick 
eleGtronics 

Primary  electronics  failures . 


(b)  Summary . 


Component 

Failures 

Apollo  hardware 

0 

Primary  electronics 

3 
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TABLE  6 . -ELEMENTS  OF  F-8  DFBW  PREFLIGHT  TESTS 


Element 

Hangar 

Flight  line 

Verify  correct  memory  load 

Yes 

Yes 

Computer  self-test 

Yes 

Yes 

Inertial  measurement  unit  fail  discretes 

Yes 

No 

Inertial  measurement  unit  turn-on 

Yes 

Yes 

sequence 

Proper  aline 

Yes 

Yes 

Pilot  gimbal  angle  indicator 

Yes 

Yes 

Inertial  measurement  unit  operational 

Yes 

No 

test  (12  minutes) 

Primary/backup  control  system 

■ Yes 

Yes 

moding 

Gain  switch  discretes 

Yes 

Yes 

Wing  position  discrete 

Yes 

Yes 

Forced  computer  restart 

Yes 

Yes 

Inertial  measurement  unit  interface 

Yes 

No 

zero  and  reset 

Forced  computer  fail  discrete 

Yes 

Yes 

Mode  panel  warning  lights 

Yes 

Yes 

Differential  D/A  output  — backup 

Yes 

No 

control  system  downmode 

Trim  rate  and  trim  fail  detection 

Yes 

Yes 

Stick-to-surface  gearing  measurements 

Yes 

No 

Computer  activity 

Yes 

Yes 

Check  failure  monitor  box 

Yes 

Yes 

Maximum  surface  deflections 

Yes 

Yes 

Load  time-of-day 

No 

Yes 

Load  computer  for  flight 

No 

Yes 

Evaluation  by 
additional  pilots 


Figure  1 . F-8  DFBW  flight  test  summary . 


Trim 
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Figure  3 . Digital  flight  control  law  diagram  . 


Yaw  SAS:  aileron-to-rudder  Interconnect 
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Figure  3 . Continued . 


Integration 


Four  vertical 
bending 
modes 


Compensation 

filter 


231 


(a)  Uncompensated’ system  locus 


(b)  Locus  with  lead-lag  compensation . 
Figure  7.  Sampled-data  system  design. 
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deg/deg/sec 


(b)  Improvement  in  Dutch-roll  damping  for  increase  in  yaw  rate  gain 
250  KIAS , 6100  m . 


Figure  10.  Continued. 
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6 

Time,  sec 


8 


(a)  Effect  of  SAS  on  damping  ratio.  Pulse  pilot  input. 


Kq  = 0.5,  no  washout  filter, 
= 1.5  deg/sec 


Kq  = 0.5,  with  washout  filter, 

%s  d®9/sec 


0 2 4 6 8 10 


Time,  sec 

(b)  Effect  of  washout  filter  on  steady  state  response . Step  pilot  input . 
Figure  12.  Pitch  SAS  operation  at  low  speed.  180  KIAS;  wing  up. 


-Power  approach  design  envelope 


•Direct  mode 


-Command  augmentation  system  mode 


2 3 ■ 4 5 

Time,  sec 


(a)  180  KIAS , 4570  m , = 2.0  deg/g . 


\ ^Direct  mode 

\ / 

^-Cruise  design  envelope 
y/  Command  augmentation 
/A  system  mode  — x. 


(b)  250  KIAS  , 4570  m , =1.5  deg/g . 

Figure  13.  C*  response  of  F-8  DFBW  aircraft. 
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Pilot  rating 
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Figure  18.  Ground-controlled  approach  handling  qualities  summary.  Light-to-moderate  turbulence. 


Little  stick  activity,  excellent 
control  of  descent  rate 
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Figure  18.  Concluded. 
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Figure  19 . Improvement  in  lateral-directional  flying  qualities  in  gunsight 
tracking  maneuver . 
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Pilot  rating 
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Figure  20 . Pilot  opinion  of  lateral-directional  flying  qualities  in  guns^ht  tracking  maneuver . 
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(a)  Program  change  proeedure 


Figure  22  . Software  managepnent . 
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1 I Engineering  requirements 


2 Construct  deck  with 
desired  memory  load 


4 Sequential  duplicate 
deck  punched 


7 Paper  tape  punched 


5 Examine  listing  for 
any  errors  detected 


Load  computer 
and  display 
memory  sums 

[ Iron  bird  simulation 

1 

8 Compare  with  predicted 
memory  sums 


10  Flight  ready 


(b)  Procedure  for  new  erasable  memory  load . 
Figure  22.  Concluded. 


252 


N76-311 


A PILOT'S  OPINION  OF  THE  F- 8 DIGITAL  FLY-BY-WIRE  AIRPLANE 

Gary  E . krier 

NASA  Flight  Research  Center 


SUMMARY 


The  handling  qualities  of  the  F-8  digital  fly-by-wire  airplane  are  evaluated  by 
using  the  Cooper-Harper  rating  scale.  The  reasons  for  the  ratings  are  given,  as 
well  as  a short  description  of  the  flying  tasks  . It  was  concluded  that  the  handling 
qualities  of  the  airplane  were  good  in  most  situations,  although  occasional  ratings  of 
unsatisfactory  were  given . 


INTRODUCTION 


A standard  F-8C  aircraft  was  equipped  with  a roll  damper,  a yaw  damper,  and 
an  aileron-to-rudder  interconnect . The  airplane  had  no  pitgh  damper . Handling 
qualities  were  satisfactory  throughout  a large  portion  of  the  flight  envelope . 

/ 

This  paper  evaluates  the  airplane's  handling  qualities  on  the  basis  of  the 
Cooper-Harper  rating  scale  (ref.  1 and  fig.  1)  after  the  removal  of  the  mechanical 
control  links  and  the  addition  of  the  Apollo  hardware  digital  fly-by-wire  control 
system . 

A force  side  stick  controller  was  mechanized  in  the  analog  backup  control  system 
and  was  evaluated  by  using  the  same  tasks  as  those  used  to  evaluate  the  digital 
primary  control  system . 

The  yaw  axis  was  not  extensively  evaluated  , so  results  are  not  reported  in  this 
paper . 

The  primary  purpose  of  the  program  was  to  expeditiously  demonstrate  the  feasi- 
bility and  reliability  of  a digital  fly-by-wire  control  system  for  an  airplane . The 
space-proved  Apollo  system  was  adapted  to  the  airplane,  forcing  compromises  that 
did  not  allow  optimization  of  the  airplane's  handling  qualities.  Nevertheless,  the 
handling  qualities  were  mostly  satisfactory. 
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SYMBOLS  AND  ABBREVIATIONS 


BCS 

analog  backup  control  system 

CAS 

command  augmentation  system 

DIR 

direct  mode  of  control 

q 

dynamic  pressure 

SAS 

stability  augmentation  system 

x-plane 

from  wingtip  to  wingtip  of  a target  aircraft 

y-plane 

from  nose  to  tail  of  a target  aircraft 

CENTER  STICK  HANDLING  QUALITIES 


Takeoff 

Takeoffs  with  the  F-8  digital  fly-by-wire  airplane  were  normally  made  using  the 
stability  augmentation  system  (SAS)  in  all  axes . This  gave  a well  damped  aircraft 
that  handled  turbulence  effectively . Bank  angle  control  was  good  and  could  be  set 
quickly  and  relatively  precisely . A pilot  rating  of  2 on  the  Cooper-Harper  scale 
was  given  for  the  takeoff  and  eiimbout  (figs.  2 and  3) . 


Cruise 


Control  for  cruising  flight  was  easily  adequate  and  is  not  further  discussed  in 
this  paper  . 


Gross  Maneuvering  and  Aerobatics 

Pitch  and  roll  control  for  any  moderate  to  high  rate  maneuver  was  similar  in 
each  flight  control  system  configuration . Maneuvers  performed  with  the  backup  con- 
trol system  (BCS)  , direct  mode  (DIR) , SAS , and  command  augmentation  system 
(CAS)  appeared  very  much  alike  to  the  pilot » which  suggests  that  these  were  not 
good  tasks  for  an  evaluation . 


Formation  Flight 

The  ability  to  fly  good  wing  and  trail  formation  (fig . 4)  is  a requisite  for 
fighter'  aircraft . It  is  also  a task  that  rapidly  exposes  deficiencies  in  the  flight 
control  system.  Poor  control  harmony  between  pitch  and  roll,  poor  damping, 
incorrect  time  constants,  undesired  force  gradients,  and  other  problems  are  all 
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revealed  when  the  aircraft  is  put  to  the  formation  task . With  a good  formation-flight 
aircraft , vertical  position  can  be  held  consistently  within  30  centimeters  and  lateral 
displacement  can  be  held  as  desired . The  task  rated  with  the  F-8  digital  fly-by- 
wire airplane  was  the  ability  to  hold  a close  wing  position  and  to  assess  the  workload 
required  to  do  it . 

While  the  airplane  was  in  the  backup  control  system , pitch  sinusoidal  oscillations 
of  ±60  centimeters  from  a base  position  were  caused  by  the  slight  delay  in  response  to 
pitch  stick  inputs.  Considerable  pilot  compensation  was  required  to  achieve  even 
that  amount  of  control.  The  response  in  the  stability  augmentation  system  was  satis- 
factory but  slightly  sluggish  because  we  were  operating  in  the  flat  portion  of  the 
stick  curve  (fig.  5) . Control  in  the  direct  mode  was  inferior  to  control  with  the 
stability  augmentation  system  because  of  underdamped  short  period  oscillations . 

By  far  the  most  difficulty  was  encountered  in  trying  to  conquer  the  roll  axis. 
Considerable  attention  was  required  on  the  part  of  the  pilot  any  time  formation  was 
attempted  in  the  roll  backup  control  system  or  the  direct  mode  • Response  was  ob- 
jectionable because  of  small  control  deflections  when  low  stick  displacements  were 
used  and  fast  response  when  the  apparent  lag  was  overcome  by  using  larger  stick 
displacements.  Using  the  roll  stability  augmentation  system  markedly  improved  the 
ability  to  hold  close  position , possibly  because  the  stability  augmentation  system 
tended  to  initially  oppose  a rapid  response  to  a pilot  input . The  stability  augmenta- 
tion system  made  the  aircraft  well  behaved  up  to  speeds  where  quantization  became 
a factor . 


Tracking 

Gunsight  tracking  with  a fixed  reticle  (fig . 6)  was  flown  because  it  was  an  ex- 
cellent way  to  assess  the  response  of  the  airplane  to  pilot  commands . The  film  was 
analyzed  frame  by  frame  to  determine  the  miss  distance,  which  was  referenced  to 
the  plane  running  through  the  target  airplane's  wingtips  (x -plane)  or  to  the  plane 
running  from  the  target  airplane's  nose  to  its  tail  (y-plane) . This  allowed  control 
difficulties  to  be  classified  as  either  a lateral-directional  or  a pitch  problem  (figs . 2 
and  3) . 

The  pilot's  ability  to  keep  the  gunsight  aiming  point  (pipper)  on  the  tailpipe  of 
the  target  airplane  in  a dynamic , tight  loop  situation  was  the  task  rated . 

Tracking  in  the  pitch  stability  augmentation  system  was  unsatisfactory  unless 
considerable  trim  was  used  to  return  the  stick  to  the  flatter  portion  of  the  parabolic 
deflection  curve  . If  the  trimming  was  omitted  , quantization  and  its  accompanying 
short  period  oscillations  caused  pipper  oscillation  in  the  pitch  plane.  Tracking  in 
the  stability  augmentation  system  with  a trimmed  stick  was  good  enough  to  perform 
the  mission  without  improvement . The  same  problems  arose  in  the  direct  mode , but 
this  mode  was  without  pitch  rate  damping , and  was  thus  rated  moderately  objection- 
able. 

The  pitch  backup  control  system  was  by  far  the  smoothest  of  the  modes  tested 
and  afforded  good  pitch  steering  at  all  angles  of  attack.  Some  short  period 
oscillations  occurred , but  they  were  not  significant . 
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The  difficulties  were  considerable  in  the  roll  axis . There  was  a definite  tendency 
toward  pilot-induced  oscillations  whenever  precise  , rapid  corrections  were  required  . 
This  was  evident  in  both  the  backup  control  system  and  the  direct  mode . The  roll 
stability  augmentation  system  reduced  the  magnitude  of  the  problem  , but  its  sensi- 
tivity degraded  the  airplane’s  ability  to  track  precisely. 

The  fixed-ratio  aileron -to-rudder  interconnect  produced  slight  proverse  yaw 
during  roll-in . This  was  considered  desirable , since  it  provided  a slight  lead  in 
the  direction  of  the  target . 


Ground- Controlled  Approach 

Ground-controlled  approaches  were  flown  using  radar  for  positioning . This  was 
an  excellent  task  for  the  evaluation  of  precision  control  during  tight  loop  instrument 
flight . Deviations  from  a preset  position  and  altitude  were  radioed  to  the  pilot , who 
then  maneuvered  the  airplane  back  toward  zero  deviation  . The  response  of  the  air- 
plane to  the  pilot-initiated  corrections  was  rated . 

Pitch  control  was  fair  in  the  backup  control  system  and  the  direct  mode  because 
of  the  short  period  oscillations  generated  by  pitch  corrections . Pitch  response  in  the 
stability  augmentation  system  was  excellent  , in  that  30-meter-per-minute  changes 
could  be  made  in  the  rate  of  descent  . Corrections  in  the  pitch  command  augmentation 
system  were  initiated  satisfactorily,  but  a distracting  tendency  to  overshoot  was 
noted  that  increased  the  pilot  workload  and  therefore  worsened  the  pilot  rating . 

Lateral  control  with  low  damping  gains  showed  some  deficiencies  because  of 
continuous  low  amplitude  oscillations  up  to  ±6°  of  bank.  No  attempt  was  made  to 
correct  this  deficiency  during  the  flight  test  program . 


Landing 

A portion  of  several  flights  was  devoted  to  the  assessment  of  the  aircraft  in 
various  control  modes  in  the  landing  pattern . The  pitch  backup  control  system  was 
relatively  smooth , and  there  was  little  tendency  for  the  pilot  to  couple  with  the  air- 
craft. In  the  direct  mode,  however  , there  was  a tendency  toward  a pilot-induced 
oscillation  during  wing  and  gear  transients . Sink  rate  control  was  fair  with  both  of 
these  modes . The  stability  augmentation  system  offered  good  pitch  control  through- 
out the  pattern,  with  reduced  transients  and  good  flare  control.  The  pitch  command 
augmentation  system  was  the  best  mode  evaluated,  but  it  masked  the  speed  stability, 
which  tended  to  lead  the  pilot  to  believe  that  changing  stick  force  meant  changing 
aerodynamic  conditions;  that  was  not  always  true. 

Flare  and  touchdown  control  were  satisfactory  as  long  as  a slight  amount  of  back 
stick  pressure  was  held  to  keep  the  airplane  off  the  flat  portion  of  the  parabolic  pitch 
curve . If  this  was  not  done , the  delay  in  response  caused  firm  landings  or  balloon- 
ing . 


Lateral  control  in  the  landing  pattern  was  characterized  by  low  damping , over- 
responsiveness , and  some  periods  of  continuous  low  amplitude  bank  excursions. 
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The  effects  of  these  characteristics  were  reduced  somewhat  by  consciously  lowering 
the  pilot's  response  and  having  him  accept  1°  to  2°  deviations  from  the  bank  angle 
desired.  This  was  considered  moderately  objectionable  in  itself  , and  coupled  with 
a strong  cr os  swind  it  became  unacceptable  . 

The  stability  augmentation  system  reduced  the  airplane's  response  to  gusts  and 
small  inputs  and  therefore  it  was  rated  better  than  the  simpler  control  modes . 


SIDE  STICK  HANDLING  QUALITIES 


The  side  stick  in  the  F-8  digital  fly-by-wire  airplane  (fig.  7)  was  installed  to 
ascertain  whether  a force  side  stick  could  be  used  to  control  an  airplane  during  most 
phases  of  flight , especially  takeoff  and  landing . No  attempt  was  made  to  optimize 
the  control  parameters , although  some  changes  were  made  for  the  flights  near  the 
end  of  the  program . The  side  stick  was  mechanized  in  the  analog  backup  control 
system , which  had  no  dampers . A side  stick  takeoff  was  considered  the  most 
uncertain  phase  of  flight  and  was  therefore  performed  only  after  side  stick  control 
was  evaluated  in  up  and  away  flight . 

1 


Takeoff 

During  side  stick  takeoffs , the  pilot  applied  nosewheel  steering  (with  the  center 
stick)  until  rudder  power  was  sufficient  and  then  moved  Ms  right  hand  to  the  side 
stick.  He  made  no  inputs  until  lift-off  speed  was  reached , when  he  applied  a smoothly 
increasing  pitch  force  to  the  stick . No  lateral  force  was  used  near  the  ground  to 
reduce  the  tendency  for  pilot-induced  oscillations . Lift-off  was  smooth  and  similar 
to  center  stick  takeoffs  except  that  the  pilot  did  not  know  the  elevator  and  aileron 
positions  through  stick  position  (figs  . 8 and  9)  . 


Gross  Maneuvering 

Gross  maneuvering  was  easy  with  the  side  stick . Maneuvers  such  as  large 
pitch  attitude  changes,  wind-up  turns,  wingovers,  and  aileron  rolls  were  performed 
without  difficulty . Crosstalk  between  pitch  and  roll  was  not  apparent . 


Formation  Flight 

Formation  flight , a high  pilot  gain  task  , was  enlightening  during  the  early  de- 
velopment of  the  F-8  digital  fly-by-wire  control  system , when  it  exposed  the  severity 
of  the  task.  Formation  flight  was  also  difficult  with  the  side  stick. 

Loose  wing  formation  flight  could  be  satisfactorily  performed  with  the  side  stick  , 
although  there  were  occasional  random  force  pulses  in  pitch  or  roll.  As  the  distance 
between  the  two  aircraft  diminished , the  pulsing  became  more  frequent  and  pro- 
nounced, indicating  the  tightening  of  the  pilot  in  the  loop.  This  resulted  in  a 
tendency  for  pilot-induced  oscillations  in  pitch  or  roll  or  both  with  the  system  as  it 
was  mechanized , that  is  , without  dampers  and  without  attempts  at  optimization. 
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Some  crosstalk  (force  interaction)  was  apparent  during  formation  flight . 
Although  its  effect  was  not  severe , it  did  start  a disturbance  in  one  axis  while  the 
pilot  was  trying  to  control  the  other  axis. 


Tracking 

Side  stick  tracking  was  typified  by  good  to  excellent  control  over  the  lateral- 
directional  axis  and  continuous  oscillations  in  pitch  caused  by  pitch  commands  that 
were  too  abrupt  and  could  not  be  smoothed . Crosstalk  was  absent  in  the  tracking 
task . 


Ground- Controlled  Approach  and  Landing 

Power  approaches  from  both  pitch  out  and  ground-controlled  approach  patterns 
were  flown  easily  with  the  side  stick . Roll  control  was  good  with  respect  to  bank 
angle  itself,  but  continuous  left  and  right  lateral  force  inputs  had  to  be  made.  This 
did  not  degrade  bank  control , but  it  did  drive  the  workload  up  quite  a bit . Pitch 
control  was  precise . 

Many  of  the  approaches  were  flown  in  turbulence,  which  had  little  adverse 
effect  on  control. 

Landings  were  characterized  by  final  approaches  that  were  well  controlled  down 
to  the  flare  point.  The  flare  was  easy  to  initiate,  and  control  was  good  almost  to 
touchdown . Just  before  touchdown  on  every  flight , the  flightpath  was  stairstep- 
like . This  was  caused  by  pulsing  pitch  inputs  from  the  pilot . 

No  large  extraneous  motion  was  generated  by  a simulated  go-around  if  the  trim 
kept  the  forces  down  to  low  levels . 


CONCLUDING  REMARKS 


The  F-8  digital  fly -by -wire  airplane  was  generally  well  behaved  throughout 
the  flight  envelope  tested . Most  of  the  handling  qualities  deficiencies  encountered 
were  a result  of  the  original  compromises  made  to  adapt  the  Apollo  system  to  the 
airplane . No  extensive  attempt  to  improve  the  Apollo-related  deficiencies  was  made . 
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Figure  1 . Cooper-Harper  rating  scale  (ref  . 1)  . 


259 


Pilot 

rating 


Figure  2 . Center  stick  pilot  ratings  in  pitch . 
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Figure  4,  Formation  flight . 


Figure  8 . Side  stick  pilot  ratings  in  pitch . 
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SUMMARY 


The  Space  Shuttle  digital,  fly-by-wlre,  flight  control  system  (FCS) 
presents  an  Interesting  challenge  In  avionics  system  design.  In  residence 
in  each  of  four  redundant  general  purpose  computers  (GPC*s)  at  lift-off  are 
the  guidance,  navigation,  and  control  algorithms  for  the  entire  flight. 

(A  fifth  GPC  hotises  a backup  FCS.)  The  mission  is  divided  into  several 
flight  segments:  first-stage  ascent,  second-stage  ascent;  abort  to  launch 

site,  abort  once  around;  on-orbit  operations,  entry,  terminal  area  energy 
management  (TAEM) ; and  approach  and  landing.  The  FCS  is  complicated  in  that 
it  must  perform  the  functions  to  fly  the  Shuttle  as  a boost  vehicle,  as  a 
spacecraft,  as  a reentry  vehicle,  and  as  a conventional  aircraft.  The  crew 
is  provided  with  both  manual  and  automatic  modes  of  operations  in  all  flight 
phases  including  touchdown  and  rollout. 


INTRODUCTION 


The  Shuttle  vehicle  configuration  is  shown  in  Figure  1.  It  consists  of 
the  orblter  vehicle,  the  orblter  external  tank  (ET),  and  two  solid  rocket 
boosters  (SRB’s).  During  Shuttle  ascent,  control  authority  is  provided  by 
thrust  vector  control  (TVC)  of  the  three  orbiter  main  engines  and  each  of 
the  two  SRB's.  Orbit  insertion  and  on-orbit  control  are  accomplished  by 
combinations  of  46  reaction  control  jets  plus  two  gimbaled  orbit  maneuvering 
engines  (orbit  maneuvering  system  or  OMS) . A blend  of  reaction  control 
system  (RCS)  Jets  and  the  aerosurfaces  is  used  during  entry;  all  aerosurface 
control  is  used  during  TAEM  and  approach  and  landing.  The  aerosurfaces 
(Figure  2)  include  the  elevens,  used  in  unison  for  pitch  control  and  differ- 
entially for  roll  control;  rudder  panels,  used  in  unison  for  rudder  control 
and  differentially  as  a speed  brake;  and  a body  flap.  Primarily  the  body 
flap  protects  the  main  engines  from  entry  heating.  However,  it  also  supple- 
ments the  elevens  for  pitch  trim. 

The  orbiter  is  a first  step  in  design  of  a control-configured  vehicle. 
It  is  statically  unstable  in  both  pitch  and  yaw  over  a large  percentage  of 
the  flight  envelope  (up  to  2 and  1/2  percent  of  the  body  length  in  pitch) . 
This  design  philosophy  has  permitted  extensive  weight  (and  hence  cost) 
savings  because  it  has  allowed  wing,  tail,  and  aerosurface  sizes  to  be 
minimized. 
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DESCRIPTION  OF  THE  SPACE  SHUTTLE  FLIGHT  CONTROL  PROBLEM 


During  Shuttle  mated  ascent,  the  PCS  consists  of  a three-axis  attitude 
command  system  (Figures  3 through  5) . Five  seconds  after  lift-off,  commands 
are  issued  to  accomplish  the .pitch-over  and  roll-to-flight-azimuth  maneuvers. 
During  regions  of  high  dynamic  pressure,  a load  relief  system  in  both  pitch 
and  yaw  minimizes  air  loads  on  the  vehicle.  The  system  is  optimized  with 
respect  to  weight  savings  (due  to  load  reductions)  versus  weight  penalties 
(due  to  added  propellant  caused  by  flight  path  dispersions  arising  from  the 
use  of  the  load  relief  system) . The  load  relief  function  is  accomplished 
by  lateral  and  normal  accelerometer  feedbacks  blended  into  the  attitude  com- 
mand system  starting  at  25  seconds  into  the  flight.  After  the  region  of  high 
dynamic  pressure  passes,  the  load  relief  function  is  blended  out  (95  seconds) . 
The  guidance  system  commands  an  open  loop  pitch  program  versus  time.  The 
trajectory  is  shaped  to  minimize  glmbal  angle  requirements  and  to  balance 
the  weight  penalties  associated  with  positive  and  negative  air  loads  due  to 
winds  and  gusts. 

During  SRB  tail-off,  which  is  sensed  as  an  acceleration  decay,  the  sys- 
tem is  commanded  to  fly  a pitch  program  versus  time  for  proper  SRB  separation 
conditions.  At  staging,  the  control  system  is  switched  to  the  second-stage 
mechanization,  which  is  a standard  three-axis  attitude  command  system 
(Figure  6) . At  a given  time,  which  corresponds  to  a predicted  dynamic 
pressure  of  25  psf,  the  guidance  loop  is  closed,  and  a form  of  linear  tangent 
steering  is  used  to  guide  the  vehicle  to  the  orbit  insertion  point.  In 
addition  to  the  automatic  modes  described,  an  augmented  manual  capability  is 
provided  in  both  first  and  second  stages  of  flight. 

The  abort  modes  are  not  discussed  in  this  paper. 

In  the  on-orbit  flight  phase  the  crew  is  provided  with  the  13  manual  and 
automatic  control  modes  listed  in  Table  1.  Two  gimbaled,  6000-pound- thrust 
(OMS)  engines  are  used  for  large  delta-V  maneuvers.  Various  combinations  of 
forty  900-pound- thrust  reaction  jets  are  used  for  attitude  control  and  small 
delta-V  translation  maneuvers.  In  addition,  six  25-pound-thrust  RCS  jets 
are  provided  for  high  accuracy  vehicle  pointing.  The  jet  select  logic  pro- 
vides attitude  and  translational  capability  with  less  than  7 and  1/2  percent 
cross  coupling  into  adjacent  axes.  The  number  of  jets  is  predicated  upop 
the  requirement  for  a fail  operational,  fail  safe  capability  throughout  a 
mission. 

The  entry  flight  control  system  (Figures  7 through  9)  is  a blend  of 
RCS  and  aerosurface  control  effectors.  During  the  early  portions  of  entry 
an  all-RCS  control  system  is  used  (Figure  10).  When  a dynamic  pressure  of 
2 psf  is  reached  (sensed  from  vehicle  accelerations),  the  elevons  are  acti- 
vated to  provide  a pitch  and  roll  trim  supplement  to  the  RCS  system.  When  a 
dynamic  pressure  of  10  psf  is  reached,  the  elevons  provide  sufficient 
authority  for  roll  control,  and  the  roll  jets  are  Inhibited.  When  a dynamic 


272 


Table  1.  On-Orbit  Control  Modes 


Mode 

Manual  direct  rotation  acceleration  command 
Manual  direct  translation  acceleration  command 
Manual  direct  translation  pulse  command 
Manual  direct  rotation  pulse  command 

Three-axis  manual  proportional  rate  command  augmentation 

Manual  RCS  rotation  discrete  rate  command  augmentation 

Three-axis  attitude  hold  mode 

Three-axis  automatic  attitude  command 

Automatic  RCS  local-vertical  barbecue  attitude  command 

Three-axis  automatic  inertial  barbecue  command 

Two-axis  aptomatic  RCS  translation  command 

Automatic  OMS  thrust-vector  control 

Manual  OMS  thrust  vector  control  command  augmentation 


pressure  of  20  psf  is  reached,  the  pitch  jets  are  inhibited,  the  yaw  jets 
being  retained  for  yaw  stabilization  and  control.  During  the  majority  of 
entry  the  vehicle  is  statically  unstable  in  yaw.  However,  the  stick-fixed 
dutch  roll  mode  is  dynamically  stable.  The  control  system  takes  advantage  of 
this  stability  in  that  the  vehicle  is  permitted  to  oscillate  within  course 
dead  bands  in  roll  and  yaw,  thus  avoiding  an  excess  usage  of  RCS  for  yaw 
stabilization. 

The  heating  rates  and  total  heating  load  to  the  vehicle  are  minimized 
by  flying  the  high-speed  portion  of  entry  (down  to  8000  feet  per  second)  at 
high  angles  of  attack  (approximately  30  degrees) . At  Mach  8,  an  angle-of- 
attack  transition  is  initiated,  ending  at  an  angle  of  attack  of  approximately 
10  degrees  (roughly  the  maximvun  lift-to-drag  condition)  and  a velocity  of 
approximately  1500  feet  per  second.  During  this  transition,  the  vertical 
tail  and  rudder  become  effective.  At  an  angle  of  attack  of  18  degrees 
(Mach  5)  the  rudder  control  is  activated.  By  the  time  the  vehicle  reaches  an 
angle  of  attack  of  10  degrees  the  rudder  is  fully  effective,  and  the  yaw  jets 
are  thereafter  inhibited.  The  FCS  is  switched  to  conventional  aircraft  con- 
trol mode  for  the  TAEM  phase  of  flight.  Manual  and  automatic  modes  during 
entry  are  similar,  the  only  difference  being  the  substitution  of  a guidance 
steering  command  in  the  auto  system  instead  of  the  rotation  hand  controller 
output  in  the  manual  system. 

The  TAEM  flight  phase  is  initiated  at  a velocity  of  about  '1500  feet  per 
second  during  entry  with  a corresponding  altitude  of  approximately  70,000  feet. 
This  flight  phase  extends  to  the  approach  and  landing  interface  at  approxi- 
mately 10,000  feet.  During  this  period,  the  guidance  system  issues  commands 
to  control  the  dynamic  pressure  and  energy  state  of  the  vehicle  and  to 
provide  steering  commands  to  arrive  at  the  approach  and  landing  interface  in 
alignment  with  the  runway  (Figure  11) . Three  basic  control  modes  are 
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provided  to  the  crew;  manual  direct  (MD) , control  stick  steering  (CSS) , and 
automatic.  The  manual  direct  mode  (Figures  12  through  14)  is  strictly  a 
backup  in  which  no  augmentation  is  used  (i.e.,  all  feedback  loops  are  open). 

When  the  crew  selects  control  stick  steering,  the  basic  mode  of  operation 
becomes  a command  augmentation  system  (CAS).  It  is  implemented  as  ati  Ng  com- 
mand (normal  load  factor)  mechanization  in  pitch  (yaw  is  similar) , and  roll 
rate  is  commanded  into  the  roll  channel  (Figures  15  through  19) , Two  submodes 
to  CSS  are  available.  One  is  attitude  hold  in  pitch  and/or  roll  (Figures  20 
and  21).  When  the  stick  is  out  of  detent,  the  CAS  mode  is  operational;  when 
the  Stick  is  returned  to  detent,  the  attitude  function  is  initiated  at  the 
attitude  existing  at  the  time  the  stick  was  returned  to  detent,  A second  sub- 
mode to  CSS  is  an  indicated  air  speed  (IAS)  hold  (Figure  22).  In  this  mode, 
the  speed  brakes  are  commanded  to  maintain  the  air  speed  commanded  by  the 
crew.  When  the  IAS  is  not  selected,  speed  brake  control  is  a manual  function. 

In  the  auto-TAEM  mode,  Ng  commands  are  issued  from  the  guidance  system 
to  the  pitch  and  yaw  channel,  and  roll  commands  are  issued  to  the  roll 
channel.  This  is  shown  in  Figure  23  for  the  pitch  axis. 

After  the  vehicle  exits  blackout  during  entry,  a TACAN  (tactical  air 
navigation)  navigation  aid  is  acquired  by  the  communication  system  for  navi- 
gation update.  The  guidance  system  steers  the  vehicle  to  intercept  a heading 
alignment  circle  to  bring  the  vehicle  to  the  approach  and  landing  interface. 

As  the  vehicle  rounds  the  heading  alignment  circle  (Figure  24) , its  orienta- 
tion becomes  such  that  the  antennas  capture  a microwave  scan  beam  landing 
system  (MSBLS)  navigation  aid.  This  will  occur  at  an  altitude  of  roughly 
14,000  feet.  When  lock-on  is  verified,  the  flight  phase  switches  from  TAEM 
to  the  approach  and  landing.  The  same  three  basic  modes  are  available  to  the 
crew  as  discussed  for  TAEM  (i.e.,  manual  direct,  CSS,  and  auto).  The  manual 
direct  and  CSS  modes  are  as  described  for  the  TAEM  phase.  In  the  autoland 
mode  (Figure  18) , the  guidance  system  issues  attitude  commands  to  the  vehicle 
to  fly  down  a steep  glide  slope,  which  varies  from  21  to  24  degrees  depending 
upon  the  payload  weight  (Figure  25) . The  speed  brakes  are  modulated  to  hold 
an  air  speed  of  290  knots.  At  an  altitude  of  1800  to  2000  feet,  depending 
on  payload  weight,  a preflare  maneuver  is  commanded  to  bring  the  vehicle 
exponentially  to  a 3-degree  glide  slope.  A final  flare  is  commanded  at 
approximately  200  feet  altitude,  and  the  vehicle  nominally  lands  with  a sink 
rate  of  about  2 and  1/2  feet  per  second  and  about  4000  feet  down  the  runway. 
When  main  gear  touchdown  is  detected  (by  a squat  switch),  the  normal  and 
lateral  acceleration  feedbacks  (in  CSS)  and  Integrator  loops  (in  auto)  are 
opened,  and  a pitchdown  command  is  issued.  Roll  commands  are  driven  to  zero. 
Lateral  steering  is  initially  accomplished  with  the  rudder.  After  the  nose 
gear  slapdown  has  been  verified,  and  after  the  velocity  is  reduced  to  approxi- 
mately 110  knots,  nose  wheel  steering  is  engaged.  The  rest  of  the  rollout  is 
, accomplished  with  the  rudder  and  nose  wheel  steering.  The  autoland  function 
is  totally  automatic  with  the  exception  of  gear  extension  (h  = 500  ft)  and 
runway  braking,  which  are  done  manually. 
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DESCRIPTION  OF  THE  SPACE  SHUTTLE  FLIGHT  CONTROL  SYSTEM  MECHANIZATION 


The  flight  control  problem  just  described  is  essentially  controlling  a 
large  number  of  quite  different  flight  phases,  some  of  which  include  unstable 
vehicle  dynamics.  Thus,  flight  control  is  a flight  safety-critical  function 
that  must  have  great  flexibility.  The  concept  chosen  for  flight  control  is 
an  all-digital,  fly-by-wire  implementation  that  uses  several  general-purpose 
computers  connected  by  serial  digital  data  buses  to  remotely  located  multi- 
plexer/demultiplexer units  (MDM's).  The  MDM’s  in  turn,  are  connected  to  the 
fli^t  control  sensors,  effectors,  and  controls.  The  guidance  and  navigation 
problems  are  solved  by  this  same  mechanization  (with  the  appropriate  addi- 
tional sensors) . It  is  used  for  all  flight  phases  and  elements , including 
control  of  the  SRB’s  during  ascent.  The  block  diagram  of  this  configuration 
is  shown  in  Figure  26. 

Efficiency  of  presentation  requires  that  the  computer  complex  be 
described  first,  including  the  MDM’s  and  data  buses.  Then  the  operating 
configuration  of  the  flight  control  equipment  will  be  described. 

Figure  27  illustrates  the  internal  configuration  of  the  computer  and 
associated  elements  of  the  central  digital  elements  (collectively  denoted  as 
the  digital  processing  subsystem  or  DPS) . At  the  core  of  the  DPS  are  five 
general  purpose  computers.  Each  GPC  is  a modified  IBM  AP-101  central  proc- 
essor unit  and  core  memory  with  a special  input/output  processor  (lOP)  that 
Interfaces  with  27  serial  digital  data  buses.  The  memory  contains  64,000 
32-bit  words  with  a nominal  one-microsecond  cycle  time.  The  lOP  contains  a 
master  sequencer  and  27  data  bus  conttol  elements.  Under  overall  control  of 
the  master  sequencer,  each  data  bus  control  element  has  the  capability  to 
send  and  receive  data  over  its  particular  data  bus.  In  addition  to  data,  the 
transmittals  Include  commands  to  other  equipment  connected  to  the  bus.  In 
addition  to  the  ability  to  request  and  subsequently  receive  data  on  the  bus, 
each  data  bus  control  element  caii  monitor  data  on  the  bus  resulting  from 
other  data  bus  control  elements  (associated  with  other  GPC’s).  This  monitor- 
ing capability  is  fundamental  to  the  processing  of  flight  control  sensor 
data,  as  will  be  described. 

Of  all  the  data  buses,  those  central  to  this  discussion  are  the  eight 
dedicated  to  guidance,  navigation,  and  flight  control  and  the  five  inter- 
computer data  buses.  Each  of  these  buses  is  connected  to  all  of  the  GPC’s. 
Also,  those  eight  buses  dedicated  to  the  guidance,  navigation,  and  flight 
control  functions  are  connected  to  four  MDM’s  located  in  the  forward  end  of 
the  vehicle,  another  four  located  in  the  aft  end  of  the  vehicle,  and  various 
devices  to  Interface  with  controls,  displays,  event  controllers,  and  the  main 
engines.  Each  flight  control  sensor  and  effector  is  connected  to  one  of  the 
aforementioned  eight  MDM’s,  and  communication  between  all  flight  control 
elements  is  via  these  buses. 

Data  transmittal  over  this  bus  network  is  by  time  division  multiplex 
techniques  at  a one-megabit  data  rate;  each  word  is  28  bits  with  the  first 
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three  bits  used  for  synchronization  and  distinguishing  between  comiaand  and 
data  formats.  The  next  five  bits  identify  the  address  of  the  word  destina- 
tion or  source,  as  appropriate.  The  rest  of  the  word  is  devoted  to  command 
or  data  information,  except  for  the  last  bit,  which  is  a parity  bit.  Each  bus 
operates  in  a half-duplex  mode. 

The  function  of  each  MDM  is  to  interface  between  the  serial  data  streams 
on  the  bus  and  the  several  elements  connected  to  it.  The  interfaces  between 
the  MDM  and  the  several  elements  may  be  analog,  digital,  or  discrete  and 
may  generally  be  in  either  direction.  Several  hundred  elements  can  typically 
be  connected  to  the  MDM,  the  exact  number  being  dependent  upon  the  specific 
mix  of  analog,  digital,  and  discrete  interfaces. 

Data  for  use  in  a GPC  are  obtained  by  a request  (under  GPG  software 
control)  being  issued  through  the  lOP,  over  a data  bus,  to  a specific  MDM 
(or  other  interfacing  element),  and  then  to  the  particular  device.  The  reply 
(usually  data)  follows  the  reverse  path.  Because  of  the  monitoring  capability 
of  each  data  bus  control  element,  each  GPC  can  receive  the  data,  even  though 
only  one  requested  it.  This  feature  is  used  to  advantage  in  the  flight  con- 
trol system,  as  will  be  described,  The  intercomputer  buses  are  used  for 
exchange  of  data  between  GPG's. 

The  five  computers  are  synchronized  only  at  each  minor  cycle  (40  milli- 
seconds) and  are  then  only  synchronized  close  enough  to  ensure  "sequence 
synchronization"  between  machines;  l.e.,  all  machines  are  on  the  same  minor 
cycle  except  for  a small  interval  near  the  beginning  or  end  of  a minor  cycle. 

With  this  summary  description  of  the  central  digital  processing  sub- 
system, it  is  now  possible  to  describe  the  mechanization  of  the  flight  control 
system.  The  system  uses  both  rate  gyros  and  lateral  accelerometers  as  basic 
stabilization  sensors;  inertial  measuring  unit  (IMU)  glmbal  data  are  used  for 
certain  attitude  hold  and  attitude  command  modes.  Three  sets  of  rate  gyros 

are  used,  two  on  the  SRB's  and  one  set  on  the  orbiter.  Each  set  consists  of 

three  axes,  and  each  axis  is  triply  redundant.  There  are  two  sets  of  lateral 
accelerometers,  one  foirward  and  one  aft  on  the  orbiter.  Each  set  senses  the 
two  axes  orthogonal  to  the  vehicle  roll  axis,  and  each  axis  is  triply  redun- 
dant. , Each  redundant  instrument  in  a set  is  connected  to  a different  MDM. 
Gontrols  are  generally  triply  redundant  within  each  set,  and  most  controls 
are  duplicated  between  the  left  and  right  seats  in  the  cockpit. 

The  effectors  vary  for  each  flight  phase.  Of  primary  concern  are  the 
effectors  used  during  the  so-called  "critical  flight  phases,"  those  during 
which  a hard-over  failure  of  an  axis  would  lead  to  vehicle  loss  before  the 
fault  could  be  rectified  by  crew  actions.  Most  of  the  nonorbital  portions 
of  flight,  both  ascent  and  return,  fall  into  this  category.  The  flight 

control  system  must  be  designed  to  tolerate  any  two  failures  and  still 

permit  safe  vehicle  and  crew  recovery.  The  flight  control  effectors  used 
during  these  flight  periods  have  multiple  input  ports  at  the  hydraulic 
secondary-valve  level.  These  multiple  inputs  are  normally  used  in  a force- 
fight  mode.  The  multiple  inputs  are  also  compared,  and  any  deviation  of 
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one  input  from  the  others  of  a specified  amount  for  a specified  time  results 
in  that  input  channel  being  "kicked  out"  by  the  actuator  itself.  These 
"pseudo- VO ting"  actuators  protect  against  two  different  input  failures.  Upon 
occurrence  of  a first  failure,  the  action  is  the  same  for  both  the  ascent  and 
return  flight  phases:  the  bad  channel  is  removed,  and  operation  continues 

with  the  remaining  channels.  Upon  occurrence  of  a second  failure,  the 
response  varies  according  to  the  flight  phase.  The  thrust  vector  control 
actuators  used  during  ascent  have  only  three  input  ports,  and,  upon  occur- 
rence of  a second  failure,  the  actuator  simply  centers  that  axis  on  that 
engine.  Because  there  are  multiple  thrusters  (three  orbiter  main  engines  and 
two  SRB’s),  loss  of  thrust  vector  control  in  one  axis  is  not  flight  critical. 
The  mission  can  continue  after  the  loss  of  thrust  vector  control  from  one 
axis.  During  the  return  portions  of  flight,  things  are  different.  There  is 
essentially  only  one  of  each  basic  flight  control  surface,  and  centering  of 
a surface  would  generally  lead  to  loss  of  the  vehicle.  Consequently,  the 
flight  control  effectors  during  these  portions  of  flight  have  four  input 
channels.  After  the  first  failure,  operation  Continues  with  the  remaining 
three.  After  failure  of  the  second,  failure  detection  and  isolation  of  the 
bad  input  channel  is  easily  detected  by  conventional  comparison  techniques, 
and  operation  continues  with  the  remaining  two  channels. 

During  these  critical  flight  phases,  the  flight  control  system  is 
configured  as  shown  in  Figure  28.  At  the  beginning  of  each  flight  control 
computational  cycle  (denoted  as  a minor  cycle  and  equal  to  40  milliseconds) , 
the  itb  GPC  requests  data  from  the  ith  sensor.  Because  the  Involved  data 
buses  are  connected  to  all  GPC Vs,  each  GPC  receives  the  data  from  the  ibb 
sensor,  either  directly  (in  the  case  of  the  ith  gpC)  or  via  the  monitoring 
capabilities  of  the  other  GPC's.  GPC’s  1 through  3 are  involved  in  data 
requests;  GPC’s  receive  data  nominally  only  through  the  monitoring  of  bus 
traffic,  but  can  assume  the  data  request  function  of  a failed  GPC.  The  result 
is  that  all  GPC's  have  all  of  the  sensor  data. 

Each  computer  selects  a single  set  of  data  for  use  in  the  flight  control 
computations.  Until  an  instrument  failure  is  detected,  the  computer  simply 
selects  the  middle  value  of  the  three  data  valiies  for  each  measurement.  Upon 
detection  and  isolation  of  an  instrument  failure  (by  combined  hardware  and 
software  tests),  the  computer  simply  averages  the  data  from  the  remaining 
two  instruments.  Upon  detection  and  isolation  of  a second  failure  (again  by 
a combination  of  hardware  and  software  tests) , the  computer  uses  the  data 
from  the  remaining  good  sensors.  Since  all  computers  have  the  same  input 
data  and  use  the  same  data  selection  algorithms,  all  computers  use  the  same 
specific  sensed  values  in  the  flight  control  computations. 

On  the  downstream  side  of  the  computer,  each  computer  is  assigned  to  a 
specific  input  port  of  each  flight  control  effector.  Thus,  if  a computer 
should  fail,  the  effect  at  the  system  level  is  simply  a small  transient 
because  of  the  momentary  incorrect  force  fight  within  the  actuator.  If  such 
a failure  occurs  during  ascent,  GPC  4 assumes  the  role  of  the  failed  machine, 
and  the  failure  tolerance  of  the  system  is  returned  to  the  same  as  it  had  at 
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launch.  During  entry  through  landing,  four  machines  are  nominally  connected 
to  the  four  input  ports  of  each  control  effector.  However,  during  these 
return  phases,  no  GPC  is  brought  in  to  replace  a failed  machine,  since  the 
ability  to  tolerate  two  failures  exists  without  such  replacement. 

Because  all  GFC’s  are  connected  to  all  buses,  and  thus  to  all  MDM's,  It 
would  be  possible  to  operate  the  flight  control  equipment  in  a "master-slave" 
configuration;  that  is,  one  GPC  would  command  all  actuator  ports  until  detec- 
tion of  its  failure,  at  which  time  another  GPC  would  assume  conunand.  This 
concept  was  rejected  because  of  difficulty  in  proving  that  the  master  GPC 
would  be  made  to  relinquish  control  in  all  possible  failure  conditions. 

A difficulty  of  operating  flight  control  equipment  in  the  parallel 
string  configuration  just  described  is  possible  divergence  between  the 
parallel  control  channels.  This  problem  manifests  itself  by  the  commanded 
control  signal  from  each  computer  differing  from  those  issued  by  other  com- 
puters by  ever  increasing  amounts.  In  the  Shuttle  configuration,  this  would 
quickly  cause  various  control  channels  to  "kick  out,"  even  though  no  failures 
had  occurred.  The  problem  is  caused  by  "noise"  getting  into  the  control 
channel  that  contains  Integrators.  The  nplse  can  be  from  traditional  ampli- 
tude variations  (which  could  result  from  different  channels  using  different 
sensors)  or  it  could  be  a result  of  timing  differences  between  channels. 

With  "noise"  and  integrators  in  the  control  channels  (almost  always  present 
for  reasons  of  stiffening  control  loops  or  providing  automatic  vehicle  trim 
capabilities),  the  problem  will  occur  even  when  the  loops  are  closed  by  a 
common  set  of  vehicle  dynamics. 

There  are  two  besic  ways  of  solving  this  problem.  One  is  to  provide 
appropriate  channel  coupling  to  stabilize  the  divergence;  the  second  is  to 
suppress  data  and  timing  variations  between  channels.  For  the  Space  Shuttle, 
the  latter  has  been  chosen.  As  mentioned,  common  sensor  data  are  selected 
by  Identical  algorithms  operating  on  Identical  data  sets  in  all  GPC's,  and 
the  GPC’s  are  sequence-synchronized  to  prohibit  divergence  from  timing 
variations . 

During  noncritical  flight  phases,  mostly  on  orbit,  the  flight  control  is 
operated  as  an  active-standby  system,  with  one  GPC  in  entire  control  and  a 
second  available  for  takeover  should  the  first  fall.  The  effectors  on  the 
QMS  engines  are  also  operated  in  an  active-standby  mode.  RCS  jets  are 
operated  with  somewhat  conventional  jet-select  logic. 

During  all  flight  phases,  the  fundamental  flight  control  computational 
cycle  is  40  milliseconds.  A number  of  flight  control  computations  take 
place  only  every  80  milliseconds,  and  some  take  place  approximately  once  per 
second.  In  addition  to  the' basic  40-millisecond  minor  cycle  requirement, 
the  total  delay  between  sampling  of  the  flight  control  sensors  and  trans- 
mittal of  the  resulting  command  to  the  effectors  is  constrained  to  be  no 
greater  than  20  milliseconds. 
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Software  is  provided  for  a number  of  flight  control  modes,  including 
manual  direct  (MD)  (totally  unaugmented) , control  stick  steering  (CSS) 
(significantly  augmented) , and  automatic  (guidance  loops  closed) . On-orbit 
operations  entail  many  more  modes.  Details  of  the  digital  control  laws  for 
the  multiple  flight  phases  and  multiple  flight  control  modes  within  each 
flight  phase  cannot  be  discussed  within  the  space  limitations  of  this  paper. 


CONCLUDING  REMBKS 


As  stated,  the  Space  Shuttle  digital  fly-by-wire,  fllgjit  control  system 
is  a challenge  in  avionics  system  design.  It  is  not  because  of  the  sophisti- 
cation of  the  algorithms  being  Implemented;  rather  it  is  because  of  the 
number  of  flight  phases  requiring  completely  different  control  algorithms 
and  control  effectors,  the  large  number  of  control  modes,  both  manual  and 
automatic,  and  because  of  the  sophisticated  and  complex  techniques  required 
for  management  of  redundant  systems.  It  is  one  of  the  most  interesting 
development  programs  ever  undertaken  and  because  of  that  is  one  of  the  most 
rewarding. 
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0 pitch  attitude 

0(.  pitch  attitude  command  from  guidance 

h altitude 
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Kg  normal  acceleration  gain 
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Figure  3.  Mated-Ascent  Pitch  Axis  Control 


Figure  4.  Mated-Ascent  Roll  Axis  Control 
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Figure  5. 


Mated-Ascent  Yaw  Axis  Control 
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Figure  6. 


Second-Stage  Flight  Control  Mechanization 


283 


TAEM  GEOMETRY 
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Figure  11.  Terminal  Area  Energy  Management  (TAEM)  Guidance  System 
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Figure  12.  Pitch  Axis-Manual  Direct 


Figure  15.  Pitch  Command  Augmentation 
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Figure  16.  Elevon  Summing 


Figure  17.  Command  Signal  Limiting 
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Figure  18.  Roll  Axis— Computed  Air  Speed 
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Figure  19 . Yaw  Axis— Computed  Air  Speed 


ATTITUDE 

COIViMAND 


AUTO-TAEM 

AUTOLAND 


Figure  21.  Roll  Attitude  Hold 
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Figure  22.  Indicated  Air  Speed  (IAS)  Hold 


Figure  23.  Pitch  Auto-TAEM 


291 


Figure  24*  Microwave  Scan  Beam  Landing  System  (MSBLS) 
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Figure  25.  Autoland  Trajectory 
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Figure  26.  Flight  Control  System 
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Figure  27.  Digital  Processing  Subsystem  Interface 
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Figure  28.  Basic  Avionics  Hardware  Configuration  for  Critical  Functions 
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HISTORICAL  REVIEW  OF  C-5A 


LIFT  DISTRIBUTION  CONTROL  SYSTEMS 


T.  E.  Disney 

Lockheed-Georgia  Company 
and 

D . C.  Eekholdt 

Wright-Patterson  Air  Force  Base 


SUfMARY 

Analytical  and  experimental  development  work  on  various  load  alleviation 
systems  foir  the  C-5A  is  reviewed  to  trace  the  development  of  the  technical 
and  hardware  concepts  to  the  present  time.  Variations  in  system  objectives, 
means  of  implementation  and  effects  on  loads  and  airplane  performance,  sta- 
bility and  control  are  discussed. 

This  paper  provides  a logical  lead  in  and  introduction  to  the  present 
system  - the  details  of  which  are  contained  in  the  papers  entitled  "The  C-5A 
Active  Lift  Distribution  Control  System"  by  W.  J.  Hargrove  and  "Some 
Experiences  using  Wind  Tunnel  Models  in  Active  Control  Studies"  by 
R.  V.  Doggett,  Jr.,  I.  Abel,  and  C.  L.  Ruhlin. 

INTRODUCTION 

The  work  on  load  reduction  systems  for  the  C-5A  at  the  Lockheed-Georgia 
Company  began  in  1967  and  has  progressed  through  several  system  variations 
to  the  present  major  effort  on  development  of  an  Active  Lift  Distribution 
Control  System  (ALDCS) . Figure  1 shows  the  chronological  evolution  of  these 
efforts. 

The  Aircraft  Load  Alleviation  and  Mode  Stabilization  (LAMS)  Program 
conducted  by  Boeing  Wichita  and  Honeywell  under  contract  to  the  Air  Force 
Flight  Dynamics  Lab  involved  the  C-5A  to  a small  degree.  The  Lockheed- 
Georgia  Company  participated  by  providing  C-5A  data  to  demonstrate  the  appli- 
cability of  the  analysis  methods  and  techniques  to  another  large  flexible 
airframe.  Although  the  LAMS  C-5A  System  Analysis  and  Synthesis  was  based  on 
a single  flight  condition,  the  study  results  concluded  that  a lAMS  type  con- 
trol system  could  reduce  structural  fatigue  damage  rates  during  flight 
through  turbulence  without  significant  degradation  of  basic  aircraft  stabil- 
ity and  handling  qualities. 

During  the  conduct  of  the  C-5A  static  test  program  in  mid  1969,  it  be- 
came apparent  that  some  form  of  wing  maneuver  load  reduction  system  was 


highly  desirable  for  the  purpose  of  reducing  maximum  wing  upbending  loads  - 
a "strength  design"  load  reduction  rather  than  a fatigue  load  reduction  sys- 
tem. The  subsequent  design  and  development  effort  involved  analyses  and 
test  programs  on  a system  which  used  sjnmnetrical  aileron  deflections  as  a 
means  of  altering  the  spanwise  airload  distribution  as  a function  of  load 
lector,  hence  the  name  - Lift  Distribution  Control  System  or  LDGS.  The  de- 
sire to  reduce  maximum  wing  upbending  loads  during  maneuvers  with  minimum 
elfect  on  performance  and  handling  qualities  led  to  an  active  system  having 
a dead  band  below  a load  factor  of  1.5  such  that  no  system  activity  resulted 
until  the  load  factor  exceeded  that  magnitude.  An  additional  selling  point 
this  system  was  this  "dead  band"  characteristic  which  resulted  in  no 
"black  box"  inputs  during  normal  operation.  This  latter  point  is  mentioned 
because  of  the  natural  reluctance  on  the  part  of  flight  crews  to  relinquish 
direct  control  of  the  aircraft  to  automatic  flight  controls.  This  system 
was  developed  and  flight  tested  during  late  1969  and  early  1970  and  is 
teferred  to  as  the  maneuver  LDCS  (MLDCS)  system. 

A simplified  version  of  the  MLDCS  known  as  the  Passive  LDCS  (PLDCS)  - 
fixed  aileron  uprig  position  selectable  by  the  flight  crew  - was  selected 
for  fleet  incorporation  because  it:  a.  Provided  the  desired  maximum  wing 

upbending  moment  reductions,  b.  Provided  a reduction  in  l.Og  wing  bending 
moments  and  thus  a significant  improvement  in  analytical  fatigue  life,  c. 

Was  attainable  with  a minimum  hardware  change  and  d.  Did  not  involve  "black 
box"  control  inputs  independent  of  flight  crew  commands.  The  major  detri- 
ment of  this  system  is  an  increased  drag  due  to  the  fixed  aileron  uprig 
Resulting  in  significant  takeoff  performance,  climb,  and  cruise  drag 
penalties. 

The  results  of  the  C-5  wing  fatigue  test  program  during  the  1970-1972 
time  period,  indicated  a need  for  further  wing  load  reductions  or  more 
appropriately,  wing  stress  reductions,  both  during  turbulence  and  during  low 
load  factor  maneuvering.  This  need  resulted  in  the  present  Active  Lift 
Distribution  Control  System  (ALDCS)  Program  which  was  initially  explored  by 
the  C-5A  Independent  Structural  Review  Team  (IRT)  and  recommended  for  develop- 
ment and  fleet  incorporation  by  the  IRT  in  its  report  to  the  Air  Force. 

Subsequent  sections  of  this  paper  discuss  the  objectives,  means  of 
implementation,  load  reductions  and  effects  on  performance  and  handling 
qualities  of  each  of  these  systems.  A comparison  of  these  systems  is  made 
In  the  concluding  section. 

SYMBOLS 

Bending  moment  (Wing  Swept  Axis  System) 

M*  Torsional  moment  (Wing  Swept  Axis  System) 

Characteristic  Frequency  (Cycles  per  Second) 

Equivalent  Airspeed  (Knots) 

2 

g Gravitational  acceleration  constant  (32.2  ft/sec  ) 
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^T 

stabilizer  incidence  angle 

^7 

Vertical  load  factor  at  c.g. 

^cg 

rms 

root  mean  square 

CO 

rms  stress 

LOAD  ALLEVIATION  AND  MODE  STABILIZATION  - LAIS  , , 

The  C“5A  LAMS  work  was  conducted  by  the  Boeing  Company  and  their  tech- 
nical partner,  Honeywell,  Inc.,  under  contract  with  the  Air  Force  Flight 
Dynamics  Lab.  The  Lockheed-Georgia  Company  provided  the  math  model  and 
supported  the  analysis  effort  with  their  design  background  and  baseline 
comparative  data  during  these  studies. 

The  purpose  of  the  C-5A  LAMS  work  was  to  demonstrate  that  the  LAMS 
technology  was  applicable  to  aircraft  other  than  the  B-52  and  to  establish  - 
the  potential  benefits  that  such  a system  may  offer  on  the  C-5A.  Selectio,n 
of  the  C-5A  to  provide  an  additional  aircraft  on  which  to  evaluate  the  LAMS 
technology  was  an  excellent  choice  since  the  C-5  possesses  relatively  power- 
ful-fully  powered  flight  controls  and  three  axis  stability  augmentation 
systems. 

The  major  objective  of  this  study  was  to  develop  a system  having  accept- 
able stability  margins,  retaining  or  improving  existing  aircraft  handling  , 
qualities  and  providing  a measurable  improvement  in  fatigue  damage  rate  and 
ride  quality. 

■ n 

The  resulting  C-5A  LAMS  study  is  well  documented  in  Reference  1.  For 
comparative  purposes,  only  the  pitch  axis  portion  of  this  system  will  be 
addressed  in  this  paper. 

The  pitch  axis  mechanization  of  the  C-5A  LAMS  Flight  Control  System  is 
shown  by  the  block  diagram  of  Figure  2.  The  aileron  and  spoiler  control 
loops  provide  a direct  load  reduction  source  through  alteration  of  the  lift 
distribution  magnitude  and  shape,  primarily  as  a function  of  vertical  accel- 
eration, while  the  inboard  elevator  loop  provides  an  indirect  wing  load  re- 
duction by  increasing  the  pitch  damping  to  reduce  pitch  response  in  turbu-  , 
lence.  In  addition,  it  provides  a pitch  compensation  effect  to  counter  the 
pitching  moment  increments  introduced  by  the  ailerons  and  spoilers  such  that 
handling  qualities  remain  relatively  unaffected.  The  control  column  feed 
foward  inputs  provide  cancelling  signals  to  the  normal  acceleration  and  pitch 
rate  feedback  signals  which  would  otherwise  oppose  a pilot  command. 

The  aileron  loop  provides  the  required  phasing  for  control  of  the  first 
and  second  wing  bending  modes  and  additional  gain  attenuation  for  suppress- 
ing of  undesirable  higher  order  mode  effects. 

System  performance  as  reflected  by  calculated  stress  values  at  selected 
airframe  control  points  is  summarized  by  Figure  3.  It  should  be  noted  that 
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these  stress  values  represent  analysis  of  the  gust  source  only  and  that 
total  stress  changes  for  all  load  sources  (gust,  maneuver,  landing  impact, 
taxi,  etc.)  were  not  evaluated  during  this  study. 

System  performance  relative  to  changes  in  flying  qualities  is  summarized 
by  Figure  4.  In  general,  the  response  to  pitch  rate  commands  exhibits  an 
increase  in  the  time  to  reach  a desired  pitch  attitude  change  with  the  re- 
sponse being  overdamped.  Addition  of  a normal  acceleration  signal  to  the 
inboard  elevator  channel  would  provide  faster  pitch  response  to  input  com- 
mands and  would  result  in  the  comparative  numbers  shown  under  Modified  LAMS 
FCS. 


MANEUVER  LOAD  CONTROL  - MLDGS 

During  late  1969  and  early  1970,  a study  was  conducted  of  various  means 
of  reducing  maximum  wing  upbending  moments  on  the  C-5A.  Figure  5 illustra- 
tes the  various  load  reduction  techniques  evaluated  and  provides  summary 
type  trade-off  information  relative  to  load  reduction  magnitudes,  hardware 
changes,  development  complexity,  etc.  The  uprigged  aileron  concept  was 
selected  as  the  most  practical  means  of  obtaining  significant  wing  bending 
moment  reductions  with  minimum  hardware  ’change/least  performance  penalty. 

A development  program  was  initiated  to  design,  develop  and  flight  test 
an  active  load  reduction  system.  The  primary  objectives  of  the  system  were: 

o Reduce  positive  maneuver  maximiun  wing  root  bending  moments  by  10% 
o Minimize  effects  on  handling  qualities 

o Miniraize  effects  on  aircraft  performance 

o Utilize  existing  hardware  with  minimum  new  components 

o Provide  "full  time  - fail  operative"  system. 

Since  it  was  desirable  to  reduce  the  maximum  upbending  moments  for 
"static  strength"  purposes  only,  the  concept  evolved  into  a system  having  a 
dead  band  below  1.5g  with  the  system  becoming  active  at  higher  load  factors. 
This  resulted  in  no  drag  penalty  during  takeoff,  climb,  cruise,  etc.,  except 
during  infrequent  maneuvering  to  load  factors  above  1.5. 

System  implementation  utilized  existing,  modified,  and  new  hardware  as 
shown  by  Figure  6.  Normal  accelerometers  located  at  the  wing  first  bending 
node  line  provided  "rigid  body"  motion  intelligence  with  minimum  gain  and 
phase  effects  for  higher  frequency  responses.  The  existing  pitch  and  yaw/ 
lateral  Stability  Augmentation  System  (SAS)  computers  provided  the  means  of 
introducing  desired  commands  to  the  ailerons  and  pitch  compensation  inputs 
to  the  inboard  elevators.  The  breadboard  MLDCS  computer  was  designed  to 
accept  inputs  from  the  accelerometers,  a Mach  signal  from  the  Central  Air 
Data  Computer  (CADC)  for  gain  scheduling  purposes,  a flap  position  signal  to 
deactivate  the  system  in  flaps  extended  configurations  and  a touchdown 
signal  to  deactivate  the  system  during  landing  impact  and  ground  operations. 
Outputs  were  provided  to  the  yaw/lateral  and  pitch  SAS  computers,  through 
which  aileron  and  inboard  elevator  deflections  are  commanded,  and  to  flight 
crew  monitoring  and  control  hardware.  Triple  channel  redundancies  and  fail 
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safe  features  were  incorporated  in  the  system  to  fulfill  the  full  time  fail 
operative  requirement. 

A functional  block  diagram  of  the  system  is  shown  by  Figure  7. 

Structural  load  improvement  attained  with  this  system  is  illustrated  by 
Figure  8.  The  MLDCS  affects  only  maneuver  loads  at  load  factors  above  1.5 
thus  there  is  no  significant  effect  on  fatigue  loads  resulting  from  the 
maneuver  source.  Gust  loads  are  likewise  not  significantly  affected  due  to 
both  the  rather  high  "g"  onset  level  and  the  limited  frequency  response 
range  of  the  system.  During  the  development  program,  a compromise  was  made 
on  aileron  deflection  magnitude  due  to  the  undesirable  increase  in  positive 
wing  torsion  along  with  the  desirable  reduction  in  wing  bending  moment.  De- 
sirable bending  moment  reductions  which  reduced  wing  lower  surface  axial 
stress  levels  had  to  be  limited  since  wing  front  beam  web  shear  flow  increas- 
ed significantly  due  to  the  increased  torsion  loads  as  illustrated  in  Figure 
9.  The  final  scheduled  maximum  aileron  deflection  was  set  at  ten  degrees^.. 

The  development  program  included  simulator  testing  and  flight  testing 
in  addition  to  the  analytical  investigations.  The  flight  test  program  eval- 
uated handling  qualities  and  provided  substantiating  data  for  structural 
load  reductions.  Figure  10  shows  a comparison  of  analytical  and  flight  test 
measured  bending  moments  as  function  of  load  factor  for  a representative 
flight  condition. 

The  effects  of  this  system  on  aircraft  performance  and  handling  quali- 
ties are  negligible.  During  flight  testing  it  was  difficult,  if  not  impos- 
sible, to  determine  when  this  active  system  was  operating.  A more  detailed 
discussion  of  this  system  is  contained  in  reference  2. 


PASSIVE  LIFT  DISTRIBUTION  CONTROL  SYSTEM  - PLDGS 

During  the  MLDCS  development  program,  it  became  clear  that  some  form  of 
fatigue  loads  reduction  was  highly  desirable.  Moreover,  it  was  desired  to 
simplify  the  MLDCS  from  the  standpoint  of  reduced  new  hardware  in  order  to 
obtain  early  fleet  incorporation  of  a load  reduction  system  - thus  the 
passive  LDCS  program  was  instituted. 

The  primary  objectives  of  this  system  were: 

o Reduce  positive  maneuver  maximum  wing  root  bending  moments  by  10%, 

o Provide  service  life  improvement  by  reduced  l.Og  mean  bending 

moments, 

o Minimize  effects  on  aircraft  performance, 

o Utilize  existing  hardware  with  minimum  new  components. 

The  PLDCS  concept  evolved  into  a fixed  aileron  uprig  system  with  specif- 
ic amounts  of  uprig  as  a function  of  airplane  configuration  and  flight  con- 
dition. Studies  indicated  that  the  "static"  load  reduction  objective  could 
be  attained  with  a two  position  system  having  5 degrees  of  uprig  above 
20,000  feet  and  10  degrees  of  uprig  below  20,000  feet.  The  objective  to 
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attain  a service  life  improvement  required  that  the  5 degree  setting  be  uti- 
lized in  the  takeoff  and  landing  configuration  in  order  to  provide  the  reduc- 
ed mean  load  benefit  throughout  the  flight  profile. 

System  implementation,  as  shown  by  Figure  11,  then  became  a rather 
simple  matter  of  using  the  existing  individual  aileron  trim  capability  as  an 
interim  measure  until  the  equally  simple  production  changes  could  be  incor- 
porated by  field  level  kit  installation.  The  C-5  fleet  has  been  using  the 
FIDOS,  interim  and/or  production  systems,  since  November  1971. 

The  structural  loads  improvement  attained  with  this  system  is  illustra- 
ted in  Figure  12.  Note  that  the  mean  bending  moment  is  reduced  significant- 
ly along  with  the  maximum  bending  moment. 

This  system  results  in  significant  effects  on  airplane  performance  as 
suimarized  by  Figure  13.  No  change  in  aircraft  handling  qualities  is  gen- 
erated since  the  system  involves  a fixed  configuration  change  only  which  is 
compensated  for  in  trim  by  use  of  slightly  more  airplane  nose  down  stabili- 
zer trim  setting. 

ACTIVE  LIFT  DISTRIBUTION  CONTROL  SYSTEM  - ALDCS 

In  late  1972,  the  C-5A  Independent  Structural  Review  Team  (IRT)  included 
the  development  of  an  active  LDCS  in  the  list  of  options  available  to  the  Air 
Force  as  a means  of  extending  the  service  life  of  the  C-5A  primary  wing 
structure.  Air  Force  review  of  the  IRT  options  resulted  in  a decision  to 
proceed  with  an  ALDCS  development  program  in  mid  1973.  This  program  involved 
the  Lockheed-Georgia  Company  as  prime  contractor  with  participation  of  The 
Boeing  Company  (Wichita  Division)  and  Honeywell  as  sub-contractors.  The  C-5 
System  Project  Office  was  the  contracting  authority  having  technical  and 
management  control  of  the  program  with  the  Air  Force  Flight  Dynamics  Lab 
providing  technical  assistance  and  program  review  functions. 

A unique  aspect  of  this  development  effort  was  the  use  of  a dynamically 
and  elastically  scaled  model  having  an  onboard  hydraulic  system  to  provide 
power  for  activation  of  the  ailerons  and  horizontal  stabilizer.  The  control 
system  was  operated  by  a console  mounted  analog  computer  simulation  of  the 
ALDCS  computer  using  inputs  from  the  onboard  ALDCS  sensors.  This  model  pro- 
vided an  experimental  dynamic  loads/flutter  data  acquisition  tool  with  which 
to  gain  confidence  in  the  analytical  methods  used  in  development  of  the  ALDCS 
mechanization.  The  model  wind  tunnel  test  program  was  accomplished  at  the 
NASA  Transonic  Dynamic  Variable  Density  Tunnel  at  Langley  AFB  and  involved  a 
test  team  consisting  of  personnel  from  Lockheed,  Boeing,  NASA,  and  The  Air 
Force. 

The  objectives  of  the  ALDCS  being  developed  in  this  program  are  as 
follows : 

o Reduce  gust  RMS  wing  root  bending  moments  by  30%, 

o Limit  gust  RMS  wing  root  torsional  moment  increases  to  not  more 
than  5%, 
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o Reduce  maneuver  Incremental  wing  root  bending  moments  by  30%, 

o No  increase  in  discrete  gust  wing  loads, 

o No  significant  changes  in  existing  performance  and  handling 
qualities, 

o Provide  "full  time  - fail  safe"  system, 

o Interface  with  existing  systems  and  use  existing  hardware 
where  possible, 

0 No  significant  degradation  in  flutter  margins. 

System  mechanization  was  derived  using  the  proposed  IRT  schematic  as  a 
baseline  system.  This  system  in  itself  had  its  beginnings  in  the  C-5A  LAMS 
pitch  axis  mechanization.  System  implementation  includes  PLDCS  and  involves 
use  of  existing  control  surfaces,  actuators  and  servos,  modified  SAS  and 
CADC  computers  and  new  hardware  as  shown  in  Figure  14.  A functional  diagram 
of  the  system  is  shown  in  Figure  15.  This  system,  as  was  the  MLDCS,  is 
designed  to  interface  with  existing  SAS  and  autopilot  systems.  It  should  be 
noted  that  the  basic  C-5A  autopilot  provides  a significant  reduction  in 
continuous  turbulence  induced  wing  loads  by  means  of  the  increased  pitch 
damping  effect  attained  when  in  the  attitude  hold  mode. 

The  effects  of  the  system  on  wing  load  imprrovement  during  maneuvering 
flight  are  represented  by  the  plots  of  Figure  16.  The  bending- tors ion  plot 
illustrates  the  effect  of  the  system  on  maneuvering  loads  for  a typical 
strength  design  case.  The  l.Og  shift  is  due  to  the  PLDCS  static  aileron  up- 
rig.  The  significant  slope  change  between  1.0  and  1.9g  is  the  result  of  the 
ALDCS  incremental  aileron  deflection.  For  load  factors  in  excess  of  1,9  the 
ALDCS  incremental  aileron  deflection  is  removed  such  that  at  design  limit 
load  factor  of  2.5  the  System  is  again  in  the  PLDCS  configuration.  This  is 
necessary  to  prevent  the  generation  of  a wing  front  beam  shear  flow  problem 
as  discussed  in  the  MLDCS  section. 

The  effect  of  the  AIDCS  on  the  fatigue  load  spectra  for  maneuvering 
flight  is  shown  by  the  right  hand  portion  of  Figure  16.  Note  that  at  high 
incremental  load  levels  (load  factors  greater  than  1.9)  the  two  spectra  are 
equal.  The  large  nimiber  of  maneuvers  at  load  factors  below  1.9  results  in  a 
significant  reduction  in  the  magnitude  of  the  low  and  intermediate  load 
levels.  This  is  the  area  in  which  the  majority  of  the  maneuver  source 
fatigue  damage  occurs;  thus  a significant  improvement  in  the  maneuver  source 
damage  is  realized. 

Loads  improvement  for  the  continuous  gust  source  is  illustrated  by 
Figure  17.  A typical  wing  root  bending  moment  gust  output  spectrum  i?  shown 
for  the  baseline  and  the  ALDCS  configurations.  The  effect  of  the  system  on 
the  incremental  gust  load  spectra  is  illustrated  by  the  curves  on  the  right 
side  of  Figure  17.  The  increase  in  characteristic  frequency  (Nq)  is  relative 
ly  unimportant  from  a fatigue  damage  standpoint  since  the  load  reduction 
effects  are  far  more  significant.  As  is  the  case  with  the  maneuver  spectra, 
the  baseline  and  ALDCS  curves  become  one  at  load  levels  corresponding  with 
c.g.  load  factors  greater  than  1.9. 
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The  aircraft  performance  and  handling  qualities  effects  introduced  by 
this  system  are  summarized  in  Figure  18. 

COMPARISON  OF  C-5A  IJDGS  SYSTEMS 

The  three  systems  which  have  been/are  being  developed  and  flight  tested 
are  compared  in  Figure  19  relative  to  major  objectives,  means  of  implementa- 
tion, loads  improvement  magnitudes  and  aircraft  performance/handling  quali- 
ties effects. 

It  should  be  emphasized  that  the  paramount  objective  in  each  of  these 
systems  was  some  form  of  wing  bending  moment  reduction  - either  strength  or 
fatigue  related  - with  secondary  objectives  of  system  simplicity  and  minimum 
effects  on  aircraft  performance/handling  qualities.  No  attempt  was  made  to 
provide  a "mode  stabilization/control"  function  for  purposes  of  flutter 
boundary  extension  or  ride  control  improvement. 

Some  of  the  trade-offs  or  compromises  between  conflicting  objectives  are 
apparent  from  the  comparison  chart.  Note  specifically  that  the  price  of  ob- 
taining reduced  mean  bending  moments,  as  .provided  by  the  Passive  System,  is 
an  aircraft  performance  penalty.  An  offsetting  benefit  on  this  system  was 
the  ability  to  attain  an  almost  immediate  incorporation  with  a minimum  hard- 
ware impact. 

The  next  variation  - to  provide  reductions  in  maneuver  and  gust  incre- 
mental bending  moments  while  retaining  the  reduced  mean  loads  generated  a 
significantly  larger  hardware  design /development  problem  than  that  of  the 
original  maneuver  load  control  MLDCS  and  in  addition  retained  the  performance 
penalties  of  the  passive  system. 

A comparison  of  the  effects  of  each  of  the  three  systems  on  wing  root 
loads  is  shown  by  Figure  20.  The  flight  condition  selected  for  this  illu- 
stration was  chosen  to  depict  the  initial  objective  of  reducing  maximum  up- 
bending  moment  by  approximately  10%  (actually  attained  about  9%  due  to 
bending  torsion  trade-off  effects) . The  reduction  in  the  l.Og  bending 
moment  is  about  257o  for  the  PLDCS  and  AI>DCS  while  the  incremental  bending 
moment  is  reduced  approximately  40%  by  ALDGS  for  this  condition.  Similar 
load  reductions  exist  for  other  flight  conditions. 

GONGLUDING  REMARKS 

The  work  done  over  the  past  five  years  on  the  various  LOGS  systems  has 
demonstrated  the  practicality  of  using  existing  flight  control  surfaces  and 
systems  to  affect  specific  changes  in  structural  load  distributions  and  mag- 
nitudes and/or  aerodynamic  characteristics  of  the  G-5A. 

The  attainment  of  desired  primary  objectives  has  resulted  in  certain 
compromises  in  one  or  more  of  the  many  diverse  requirements  of  such  a complex 
system  as  the  G-5A. 
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This  work  illustrates  an  application  of  active /passive  control  techno- 
logy to  the  solution  of  one  type  of  problem  on  an  existing  aircraft.  Appli- 
cation of  the  same  engineering  principles  during  the  design  stage  of  a new 
aircraft  could  have  significant  effects  on  the  overall  "design  compromise". 

At  this  point  a word  of  caution  is  deemed  necessary.  The  success  of 
the  LDCS  systems  on  the  C-5A  has  been  evaluated  on  the  basis  of  attaining 
specific  load  reductions  (primarily  wing  bending  moments).  The  significance 
of  these  load  reductions  on  the  structural  integrity  and  service  life  of  the 
airframe  has  only  been  evaluated  by  existing  state-of-the-art  structural 
analysis  and  test  methods.  Since  conventional  fatigue  analysis  methods 
treat  only  axial  stresses  in  a system  based  on  constant  amplitude  cyclic 
test  data,  little  is  known  about  combined  axial  and  shear  stress  effects  on 
fatigue.  The  message  here  is  to  proceed  slowly  and  don't  commit  to  a design 
or  a design  fix  on  the  basis  of  a partial  evaluation. 
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-5A  LIFT  DISTRIBUTION  CONTROL  SYSTEM  EVOLUTION 
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C-5A  LAMS  PITCH  AXIS  SYSTEM  MECHANIZATION 


ANALYTICAL  STRESS  ^S 


STRUCTURAL  LOC  ATION 

BASELINE 

AIRCRAFT 

LAMS 

WING  STATION  120 

207o  1 

48.  6 

WING  STATION  746 

230.  2 

82,2 

HORIZONTAL  TAIL  ROOT 

79. 1 

110.7 

FUSELAGE  STATION  1804 

42.  9 

70, 2 

FUSELAGE  STATION  1106 

39c  9 

24.0 

NOTES:  lo  GUST  INPUT  OF  1 FT/SEC  RMS 

2p  STRESS  LEVELS  ARE  PSI 
3o  STRESS  LEVELS  CALCULATED  USING 
ANALYTICAL  BENDING  MOMENTS  AND 
STRESS  TO  LOAD  RATIOS 


C-5A  LAMS  STRUCTURAL  PERFORMANCE  IMPROVEMENT 

PITCH  AXIS 


FIGURE  3 


PITCH  ATTITUDE  RESPONSE  CHARACTERISTICS  - 
ELEVATOR  SQUARE  WAVE  INPUT 


PARAMETER 

BASELINE 

(SAS) 

LAMS  FCS 

MODIFIED  LAMS* 

TIME  TO  90% 
(SECONDS) 

1.5 

2. 1 

1.7 

PERCENT 

OVERSHOOT 

15.0 

OVERDAMPED 

10 

ATTITUDE 

CHANGE 

1.92 

2.61 

2.61 

NOTE:  THE  USE  OF  UPRIGGED  SPOILERS  AS  IN  THE  LAMS  MECHANI- 
ZATION WOULD  GENERATE  A DRAG  PENALTY  THUS  A PAY 
LOAD  RANGE  EFFECT  WHICH  WAS  NOT  EVALUATED  DURING 
THE  STUDY 


C-5A  LAMS  FLYING  QUALITIES  AND  PERFORMANCE  EFFECTS 

FIGURE  4 
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C-5A  WING  LOAD  REDUCTION  TECHNIQUES  EVALUATION 


NEW  HARDWARE 

o LDCS  COMPUTER 
o WING  MOUNTED  ACCELEROMETERS 
o CONTROL  PANEL 
o ANNUNCIATOR  LIGHTS 

MODIFIED  EXISTING  HARDWARE 

o YAW/LATERAL  STABILITY  AUGMENTATION  COMPUTER 
o PITCH  STABILITY  AUGMENTATION  COMPUTER 

EXISTING  HARDWARE 

o CENTRAL  AIR  DATA  COMPUTERS 
o FLAP  POSITION  SWITCHES 
o TOUCHDOWN  SWITCHES 
o MADAR  SUBSYSTEM 


C-5A  MLDCS  SYSTEM  IMPLEMENTATION 
FIGURE  6 
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-5  MLDCS  FUNCTIONAL  BLOCK  DIAGRAM 


WING  ROOT  Mx'  - My'  ENVELOPE 
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C-5  MLDCS  STRUCTURAL  LOAD  IMPROVEMENT 
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FIGURE  9 


GW  = 595000  LBS 
Ve  = 260  KTS 
ALT  = 10,000' 
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C-5  MLDCS  COMPARISON  OF  ANALYTICAL  AND  FLIGHT  TEST  LOADS 


INTERIM  SYSTEM 

o USE  EXISTING  INDIVIDUAL  AILERON  TRIM  CAPABILITY 
o ADD  INSTRUCTIONS  TO  FLIGHT  HANDBOOK 

PRODUCTION  SYSTEM 


o INCREASE  POSITIVE  PITCH  TRIM  ACTUATOR  STOP  FROM  1.  5 
TO  2.7  DEGREES 

o INSTALL  SHORTENED  AILERON  FEED  BACK  ROD  - 6 DEGREES 
UPRIG  NEUTRAL 

o ADD  LDCS  ARM  SWITCH  AND  MOMENTARY  ON  UPRIG  AND 
DOWNRIG  SWITCH 

o ADD  INDEX  MARKS  ON  AILERON  TRIM  INDICATOR 


C--5A  PLDCS  SYSTEM  IMPLEMENTATION 
FIGURE  11 
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EFFECTS  ON  AIRCRAFT  PERFORMANCE 


o INCREASED  T.  O.  FIELD  LENGTH  OR  REDUCED  To  O.  G.  W.  OR 
INCREASED  ROTATION  SPEED 

o REDUCED  CLIMB  PERFORMANCE  (GRADIENT  REDUCED  . 23%) 
o PAYLOAD  RANGE  REDUCTION  (150  - 300  NM) 

EFFECTS  ON  HANDLING  QUALITIES 
o NO  SIGNIFICANT  CHANGE 


C-5A  PLDCS  EFFECTS  ON  PERFORMANCE  AND 
HANDLING  QUALITIES 

FIGURE  13 
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NEW  HARDWARE 

o ALDCS  COMPUTER 
o WING  MOUNTED  ACCELEROMETERS 
o CONTROL  PANEL 
o ANNUNCIATOR  LIGHTS 

MODIFIED  EXISTING  HARDWARE 

o YAW/LATERAL  STABILITY  AUGMENTATION  COMPUTER 
o PITCH  STABILITY  AUGMENTATION  COMPUTER 

EXISTING  HARDWARE 

o CENTRAL  AIR  DATA  COMPUTERS 
o AUTOPILOT  NORMAL  ACCELEROMETER 
o SAS  PITCH  RATE  GYRO 
o CONTROL  COLUMN  POSITION  SENSOR 
o FLAP  POSITION  SWITCHES 


C-5A  ALDCS  SYSTEM  IMPLEMENTATION 
FIGURE  14 


CAUTION  1 I I 1 ► CAUTION 

— J SAS  PITCH  RATE  II  "■'iJ  li  - 
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C-5A  ALDCS  FUNCTIONAL  BLOCK  DIAGRAM 
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C-5A  ALDGS  MANEUVER  LOADS  IMPROVEMENT 


WING  ROOT  BENDING  MOMENT 


uu  N 
Q X 

< z 


CM 

I 

O 


X 


320 


C-5A  ALDCS  GUST  LOADS  IMPROVEMENT 
FIGURE  17 


EFFECTS  ON  AIRCRAFT  PERFORMANCE 


o INCREASED  To  O.  FIELD  LENGTH  - (SAME  AS  PLDCS) 
o REDUCED  CLIMB  PERFORMANCE  - (SAME  AS  PLDCS) 
o PAYLOAD  RANGE  REDUCTION  - (SAME  AS  PLDCS) 


EFFECTS  ON  HANDLING  QUALITIES 


0 NO  SIGNIFICANT  CHANGES 


EFFECTS  OF  ALDCS  ON  PERFORMANCE  AND  HANDLING  QUALITIES 

FIGURE  18 
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COMPARISON  OF  G-5  LDCS  SYSTEMS 
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COMPARISON  OF  STRUCTURAL  LOAD  EFFECTS  FOR  LDCS  SYSTEMS 


THE  C-5A  ACTIVE  LIFT  DISTRIBUTION  CONTROL  SYSTEM 


William  J . Hargrove 
Lockheed-Georgia  Company 


SIIHkART 

An  Active  Lift  Distribution  Control  System  (ALDCS)  has  been  developed  for 
the  C-^A  as  a means  to  reduce  wing  fatigue  damage  due  to  maneuver  and  gust  load 
sources.  The  Lookheed-Georgia  Company  proposed  a four  phase  program-;  the  de- 
velopment and  design  of  a prototype  system,  flight  test  evaluation,  production 
system  fabrication,  and  airplane  fleet  installation  of  this  subsystem. 

This  paper  describes  the  ALDCS  development 'and  design  -basks,  ALDCS  func- 
tional oonflguiration,  and  resulting  challenges  enoounteired  'while  aooompllshing 
the  first  phase  of  the  program.  These  tasks  are  establishing  system  require- 
ments and  criteria  and  synthesizing  a system  meohanlzatlon  to  meet  the  desired 
load  alleviation,  stability  margins,  flight  safety,  and  flying  qualities  per- 
formance. Results  of  the  ALDCS  development  and  prototype  system  flight  simula- 
tion programs,  and  control  law  optimization  inoluding  system  stability,  handling 
qualities  and  structural  load  analyses  are  presented,  along  with  concluding  re- 
marks relative  to  the  system  design  integration. 


INTRODTtCTIOH 


An  Active  Lift  Distribution  Control  System  (ALDCS)  has  been  developed  by 
Lookheed-Georgia  Company  under  the  direction  of  the  DSAF  C-3  System  Project 
Office  to  reduce  wing  fatigue  damage  due  to  Incremental  maneuver  and  gust  load 
sources. 

The  ALDCS  is  an  automatic  flight  control  subsystem  which  provides  redis- 
tribution of  the  wing  spanwise  lift  through  symmetrical  deflection  of  the  ailer- 
ons by  inclusion  of  control  Inputs  to  the  existing  lateral  augmentation  sub- 
system. The  net  aileron  control  effect,  as  Illustrated  in  figure  1,  is  to  shift 
the  wing  spanwise  center  of  pressure  Inboard,  thus  reducing  the  incremental  wing 
root  bending  moments.  Control  input  signals  from  the  ALDCS  are  also  provided  to 
the  Inboard  elevator  surfaces  through  the  existing  pitch  augmentation  subsystem 
for  reduction  of  gust  induced  loads  and  to  compensate  for  the  resulting  deg- 
radation in  airplane  handling  qualities. 

Although  the  primary  objective  of  the  ALDCS  is  to  reduce  wing  loads,  min- 
imizing the  effeots  on  the  basic  aircraft  stability  and  handling  qualities  and 
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pACsF,  m.Am  not  PHJfEfe' 
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minimizing  changes  to  existing  hardware  while  utilizing  existing  control  sur- 
faces were  also  basic  design  goals. 

SYMBOIS  AKD  STJBSCRIPTS 


% 

S 

% 

a/c 

q 

g 

M 

Ve 

CADC 

C.G. 

db  , DB 

ECP 

H.fci. 

Hz 

K 

KCIS 

% 

PLDCS 

PSP 

PSD 

HMS 


Normal  acceleration  load  factor. 

Pitch  rate. 

Flap  position. 

Bending  moment. 

Aircraft 

Equivalent  dynamic  pressure. 

2 

Acceleration  constant  (52.2  ft/sec  ) 

Mach  number 

Siuivalent  Airspeed 
Central  Air  Data  Computer. 

Center  of  gravity. 

Decibel 

Elevator  cable  position. 

Handling  qualities. 

Hertz, 

One  thousand. 

Knots  calibrated  airspeed. 

Maximum  horizontal  flight  Mach  number. 
Passive  Lift  Distribution  Control  System, 
Pounds  per  square  foot. 

Power  spectrum  density. 

Root  mean  square. 
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SYMBOLS  AKD  SUBSCEIPTS  (COHT'I)) 


Vj)  Maximum  dive  flight  airspeed 

SL  Sea  level, 

Vg  Maximum  horizontal  flight  airspeed, 

V3S  Vehicle  systems  simulator, 

W.S,  ¥±ng  station. 


BACKGROOTD 


In  1969  the  Lockheed-Georgia  Company  conducted  a program  to  establish  the 
feasibility  of  reducing  the  maximum  C-5  wing  upbending  loads  during  accelerated 
flight  maneuvers.  This  effort  consisted  of  development,  fabrication  and  flight 
test  of  a prototype  subsystem  referred  to  as  the  Maneuver  LDCS  (mlDCS),  This 
subsystem  successfully  reduced  the  inner  wing  bending  moments  for  positive  ac- 
celerations above  1,5g  without  degrading  airplane -handling  qualities,  A sim- 
plified version  of  this  system  known  as  Passive  LIX^S  (PLLCS)  that  involves 
manual  aileron  uprig  through  the  trim  system  was  s^J-ected  for  the  C-5  fleet  in- 
corporation. 

In  1972  a survey  conducted  by  the  C-5  Structural  Independent  Review  Team 
(IRT)  of  the  possible  methods  to  improve  the  C-5  wing  fatigue  life  characteris- 
tics included  a recommendation  to  consider  an  active  control  system  to  improve 
fatigue  life,  A decision  was  made  jointly  by  the  USAP  C-5  Systems  Project 
Office  and  Lockheed-Georgia  Company  to  develop  and  test  such  a subsystem  which 
was  to  be  called  an  Active  Lift  Distribution  Control  System,  This  subsystem 
was  to  be  incorporated  in  addition  to  the  PLDCS.  In  May  of  1975  the  ALDCS  pro- 
gram was  initiated  for  the  development  and  test  of  a prototype  subsystem  with 
flight  testing  to  be  completed  in  July  of  1974*  The  results  of  this  program 
will  affect  a decision  to  produce  the  ALDCS  for  G-5  fleet  retrofit. 


DEVELOPMENT  METHODS 


A flow  chart  of  the  tasks  required  in  the  ALDCS  development  are  shown  in 
figure  2,  Each  task  required  direct  involvement  of  'R  number  of  engineering 
disciplines  to  insure  adequate  assimilation  of  design  requirements  and  data  and 
proper  maintenance  of  development  results  and  the  status  of  the  subsystem  mech- 
anization, One  of  the  paramount  challenges  was  the  integration  of  the  affected 
design  disciplines  into  a total  design  team  since  the  functioning  of  this  ac- 
tive subsystem  had  such  interwoven  influences  on  loads,  handling  qualities,  sta- 
bility, structural  dynamics,  and  existing  C-5  flight  control  systems.  Fortu- 
nately, the  experience  of  the  earlier  LDCS  program  provided  an  excellent  design 
example. 
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Requirements  and  Criteria 


Prior  to  synthesizing  the  ALDGS,  design  requirements  and  criteria  were 
carefully  established  as  a design  base  in  the  areas  of  structural  loads,  flight 
control  subsystems,  stability,  and  handling  qualities.  These  requirements  are; 

Structural  Loads  - 

° Continuous  turbulence  loads  analysis  shall  result  in  RMS  bending 
moments  at  the  wing  root  (wing  station  120)  not  exceeding  70^ 
of  the  free  airplane  values, 

° The  continuous  turbulence  RMS  torsion  at  the  wing  root  shall  not 
exceed  the  free  aircraft  values  by  more  than  5^» 

° The  aLDCS  shall  not  increase  discrete  gust  loads. 

° The  incremental  root  bending  momentb  load  per  g shall  not  exceed 
'J Op  of  the  free  aircraft  values  during  steady  maneuvers,  within  the 
normal  climb,  cruise,  and  descent  regime  of  the  aircraft, 

° The  AIjDCS  shall  produce  no  aileron  input  when  the  aircraft  reaches 
the  design  positive  maneuver  load  factor  of  2,5. 

° The  system  shall  not  be  required  to  operate  in  the  flaps  down 
configurations . 

° The  ALDCS  shall  operate  in  the  required  speed/altitude  flight 
envelope  as  defined  in  figure  5 for  flaps  up  configurations. 

Flight  Control  Subsystems  -- 

° The  ALLC3  shall  be  designed  to  "fail-safe"  concepts . 

® The  system  shall  be  a dual  channel  analog  design. 

^ Active  operation  of  ailerons  and  inboard  elevators  through 

existing  augmentation  and  primary  control  actuators  are  required, 

° ALDC3  will  interface  with  existing  C-5  sensors  to  the  extent 
possible  and  will  be  compatible  with  existing  C-5  automatic 
flight  control  subsystems, 

” No  ALDCS  malfunction  will  affect  normal  pitch  and  lateral 
augmentation  subsystem  operations. 

® The  existing  C-5  hydraulic  servoactuators  for  the  aileron  and 
inboard  elevators  will  be  used  without  modifications. 
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° The  ALBCS  will  be  required  to  operate  on  a "full-time  basis" 

within  the  desired  flight  envelope  and  design  criteria  boundaries. 

Stability  - 

The  incorporation  of  the  ALDCS  shall  not; 

° Induce  adverse  structural  mode  coupling. 

® Change  significantly  the  existing  maneuvering  flight  handling  qualities. 
® Induce  significant  degradation  of  existing  flutter  margins. 

“ Induce  adverse  coupling  with  existing  flight  control  systems. 

° Induce  limit  cycle  tendencies. 

The  following  ALDCS  minimum  stability  margin  and  attentuation  goals  for 
each  primary  control  surface  feedback  loop  were  established  to  meet  the 
above  system  stability  requirements.  These-  goals  were  considered  to  be 
realistic  and  attainable  throughout  the  ALDCS  flight  envelope. 

°°  Ground  Test  - 6 db  gain  margin  and  45  degree  phase  margin. 

Flight  modes  through  control  mode  natural  frequencies  - 6 db  gain 
margin  and  45  degree  phase  margin. 

Flight  modes  above  control  mode  natural  frequencies  - 6 db 
gain  margin  and  infinite  phase  margin.  There  was  also  a 
system  attenuation  goal  of  60  db/decade  established  for 
these  modes. 

Handling  Qualities  - 

® There  shall  be  no  significant  change  in  the  existing  C-5  handling 
qualities. 

® The  ALDCS  shall  be  disengaged  prior  to  the  aircraft  stall  event, 

® Criteria  for  the  C-5  handling  qualities  will  be  those  characteristics 
established  during  previous  flight  test  programs  which  concluded  the 
C-5A  flying  qualities  to  be  acceptable  in  all  cases, 

® Evaluation  pilot  comments  will  be  utilized  to  obtain  satisfactory 
results. 

Design  Data  Acquisition 

The  task  of  acquiring  necessary  design  data  was  simplified  by  the  exis- 
tence of  airplane  math  model  data,  flight  control  subsystem  mechanizations, 
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and  flight  test  response  correlation  data  from  the  original  G-5  design  programs. 
The  major  void  in  design  information  existed  in  the  characteristics  of  the  ail- 
eron and  elevator  hydraulic  servoactuators.  This  void  existed  due  to  the  C-5 
actuators  being  designed  and  tested  primarily  for  handling  qualities  evalua- 
tions and  automatic  stabilization  of  aircraft  low  frequency  short  period  and 
dutch  roll  modes,  whereas  the  ALDCS  would  encompass  the  sensing  and  active 
control  of  higher  frequency  aeroelastic  mode  dynamics,  potentially  up  to  a 
factor  of  15  above  the  short  period  frequency. 

These  missing  actuator  characteristics  not  only  included  frequency  re- 
sponse but  hysteresis , surface  rates  and  tolerance  bands  in  unloaded  and  load- 
ed conditions.  They  were  desired  for  actuators  of  various  ages  up  to  an  ex- 
pected full  life.  These  data  were  obtained  by  tests  on  the  C-5  Vehicle  Systems 
Simulator  of  new  and  worn  (over  one  life  span)  servoactuators,  by  tests  per- 
formed by  Bertea  Corporation  (the  servoactuator  manufacturer),  and  by  frequen- 
cy response  flight  tests  on  the  C-5  aircraft. 

A definite  "design  risk"  was  associated  with  the  attempt  to  utilize 
existing  C-5  servoactuators  without  bandwidth  or  authority  limit  modifications. 


Computer  Programs 


Various  computer  programs  were  prepared  and  correlated  with  flight  test 
data  to  provide  analytical  techniques  for  development  of  the  ALBCS  mechaniza- 
tion. These  programs  using  hybrid  and  digital  computation  were; 

® Stability  - Eigenvalues  and  Erequenoy  Response 

® Dynamic  Time  History  - Loads  and  Handling  Qualities 

® Accelerated  Stability  - Stick  Porce  per  *g' 

® ISD  Loads 

The  following  airplane  and  control  system  analytical  models  were  used  for 
the  above  programs. 

° Three  degrees-of-freedom  quasi-elastio longitudinal  axis  dynamic  models, 

° Six  degrees-of-freedom  quasi-elastio  longitudinal  and  lateral-directional 
axes  dyTiamic  models. 

° Eighteen  mode  aeroelastic  symmetric  axis  dynamic  models,  with  first  15 
flexible  modes  and  Wagner  and  Kussner  functions  and  gust  penetration 
effects. 

° Two  degrees-of-freedom  quasi-elastio  steady-state  maneuver  model. 

® Ei^t  mode  aeroelastic  symmetric  axis  dynamic  model  with  six  most 
significant  flexible  modes. 
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® Linear  and  non-linear  flight  control  system  servoactuator  models 


AnalyBis  and  Synthesis  Tasks 


The  analysis  and  synthesis  tasks  involved  the  development  of  an  ALDCS 
mechanization  to  meet  the  load  alleviation  requirements  and  the  determination 
of  its  effects  on  stability,  handling  qualities  and  existing  flight  control 
subsystem  performance.  Feedback  control  laws  were  synthesized  to  attain  these 
requirements  while  minimizing  system  coupling  effects  with  undesirable  struct- 
ural modes  and  rigid  body  dynamics. 

Development  of  a realistic  mechanization  that  could  potentially  be  util- 
ized as  a guide  for  production  design  required  indepth  studies  to  establish 
the  system’s  total  flight  envelope  functional  charaoteristics,  sensor  tolerance 
and  response  specifications,  and  prototype  parameter  adjust  capabilities.  Also 
involved  were  the  analyses  to  determine  effects  of  subsystem  failures, 
component  tolerance  build-up,  and  servoactuator  response  characteristics. 

Other  major  analytical  studies  were  accomplished  to  determine  the  impact  of  the 
ALDCS  on  handling  qualities  in  the  following  areas: 

® Dynamic  Stability 

® Maneuverability  (Attitude  Control) 

“ Aecelerated  Stability  (Stick  Force  per  'g' ) 

® Roll  Control  performance 

® Development  of  an  ALDCS  Handling  Qualities  Command  Model 

The  interaction  coupling  effects  of  the  flexible  bending  and  rigid  body 
response  with  the  flight  control  system  was  thoroughly  analyzed.  This  insured 
proper  control  law  compensation  for  those  flight  conditions  during  which  struct- 
ural modes  and  handling  qualities  tend  to  degrade  each  other. 


Flight  Simulation  Tasks 


Tasks  accomplished  on  the  C-5  Developmental  Handling  Qualities  Cockpit 
Simulator  provided  pilot  evaluations  of  the  ALDCS  effect  on  the  C-5  handling 
characteristics.  The  inflight  tasks  performed  by  the  evaluating  pilot  con- 
sisted of  the  following: 

® Symmetric  'g'  pull-ups 

“ Stabilized  bank  turns  and  roll-outs 

° Landing  approach  and  flare 
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° Constant  Vg*  rolling  pull-out  maneuvers 
® Take-off  rotations 

° Attitude  tracking  maneuvers  during  turbulence 

“ Air  traffic  control  maneuvering  (speed, 
altitude  and  heading  changes) 

The  c-5  Developmental  Handling  Qualities  Cockpit  Simulator  is  real-time 
six  degrees-of-freedom  simulation  with  an  all  digital  computation  and  a termi- 
nal area  terrain  model  visual  system. 


Vehicle  System  Simulator  (VSS)  Tasks 


Simulation  afforded  the  capability  to  verify  the  prototype  design  and 
system  safety  aspects  in  functional  operation  checkout  and  flight  control  sub- 
system hardware  integration.  This  technique  also  provided  final  pilot  evalua- 
tions utilizing  the  prototype  subsystem.  Pilot  tasks  were  similar  to  those 
used  on  the  C-5  Developmental  Handling  Qualities  Cockpit  Simulation  discussed 
previously. 

The  VSS  incorporates  actual  C-5  mechanical  and  hydraulic  flight  control 
systems,  moving  surfaces  and  interfacing  automatic  flight  control  subsystems. 


SCHEDULE  MILESTONES 


The  accomplishment  of  the  analysis,  synthesis,  simulation  and  design  tasks 
to  meet  a restrictive  schedule  was  paramount.  Plight  test  evaluations  of  the 
prototype  ALDCS  were  to  begin  within  eleven  months  from  contractual  go-ahead. 
Figure  4 illustrates  the  criticality  of  the  design  program  schedule.  With 
go-ahead  occurring  on  7 May  1975»  "the  subsystem  design  met  the  90  percent  func- 
tional release  date  of  21  September  1975*  The  final  mechanization  was  released 
on  the  scheduled  date  of  7 November  1973  and  the  first  prototype  subsystem  was 
made  available  for  flight  simulation  evaluation  on  7 January  1974»  Inflight 
system  evaluations  began  on  15  fferch  1974t  approximately  ten  months  after  go- 
ahead. 


SYSTEM  MECHANIZATION 

The  ALDCS  has  been  mechanized  to  meet  the  demanding  requirements  placed 
on  it  and  to  interface  with  existing  C-5  sensors,  augmentation  and  servo- 
actuation  subsystems. 
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Figure  5 provides  a simplified  interface  diagram  indicating  the  integra- 
tion of  the  ALIJCS  computer  with  the  existing  C-5  flight  control  subsystems. 

The  dual  channel  redundancy  design  ALDGS  computer  provides  signals  to  both  the 
lateral  augmentation  series  servo  to  control  the  aileron  actuators  symmetrical- 
ly and  the  pitch  augmentation  series  servo  to  actuate  the  inboard  elevator  con- 
trol surfaces.  Aileron  actuators  also  receive  commands  from  the  pilots,  auto- 
pilot, and  passive  LDGS.  The  pilots  and  autopilot  command  inboard  as  well  as 
outboard  elevators.  Figure  6 shows  the  G-5  airplane  locations  of  the  ALDGS 
sensors  and  interfacing  computers  and  affected  control  surfaces.  The  wing 
mounted  accelerometers  are  the  only  additional  G-5  sensors  required  for  ALDGS 
integration. 

The  ALDGS  mechanization  consists  of  an  array  of  sensors,  gains,  and  fil- 
ters, Figure  7 is  a block  diagram  of  the  ALDGS  simplified  mechanization  to  be 
used  as  a roadmap  during  the  insuing  discussion  of  the  individual  components 
and  system  development  changes.  The  aileron  and  elevator  channels  will  be  dis- 
cussed separately. 


Aileron  Ghannel  , 


The  aileron  control  channel  commands  the  right  and  left  ailerons  sjnomet- 
rically  to  accomplish  the  maneuver  load  relief  function.  The  feedback  sensors 
utilized  for  the  aileron  channel  are  provided  by  two  vertical  accelerometer 
locations  per  wing,  one  located  on  the  forward  main  beam  (V.S.  1186)  and  the 
other  on  the  rear  beam  (V.S,  1152)  both  at  an  outer  wing  location.  The  signals 
from  these  accelerometers  are  averaged  and  compensated  by  smoothing  filters 
that  attenuate  sensor  noise  and  aid  in  the  elimination  of  higher  frequency 
wing  vibration  modes  beyond  the  ALDGS  control  bandwidth. 

The  Stability  and  Load  Gontrol  Gain  and  Filtering  portion  of  the  aileron 
channel  provides  the  necessary  compensation  to  adequately  phase  the  feedback 
accelerometer  signals  for  control  of  the  inner  wing  bending  moments  and  to  at- 
tain the  design  goal  stability  margins, 

A pilot's  feedforward  command,  acquired  from  the  existing  C-5  elevator 
cable  position  (EGP)  transducer,  is  summed  with  the  compensated  aooeleration 
control  signal  to  provide  abrupt  maneuver  load  control.  The  feedforward  sig- 
nal is  filtered  for  proper  abrupt  load  alleviation  aileron  command  phase. 

These  control  signals  are  then  gain  scheduled  by  aircraft  dynamic  pres- 
sure from  the  Gentral  Air  Data  Gomputer  (GADG)  to  provide  proper  stability  and 
load  relief  schedules  and  to  minimize  handling  qualities  degradations  through- 
out the  airc:i^ft  speed  envelope.  Gut-off  filters  are  provided  to  preclude  ad- 
verse coupling  with  higher  frequency  uncontrolled  modes.  The  ALDGS  aileron 
command  signal  is  controlled  by  boundary  control  logic  which  contains  the  cir- 
cuitry to  disengage  the  signal  when  exceeding  flight  boundaries  where  the  ALDGS 
is-  not  required.  These  operational  boundary  conditions  are  when  the  flaps  are 
lowered,  the  Stallimiter  subsystem  is  activated,  the  airplane  exceeds  maximum 
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horizontal  airspeed/lfech  (550  KCiS  /m  = 0.825) ».  anti  when  the  airplane  load 
factor  exceeds  1,9  g’s.  These  logic  control  signals  are  obtained  from  existing 
aircraft  subsystems  with  the  exception  of  load  factor.  This  signal  is  derived 
from  ALDCS  wing  and  fuselage  accelerometers  to  closely  represent  aircraft  C.G. 
acceleration.  The  system  is  automatically  re-engaged  as  the  aircraft  re-enters 
the  ALDCS  operational  envelope.  The  aileron  command  signal  is  then  limited 
and  interfaced  with  the  lateral  SAS  aileron  series  servoactuators. 


Elevator  Channel 


The  elevator  channel  contains  three  sensors,  two  active  feedback  param- 
eters and  one  feedforward  command.  Airplane  pitch  rate,  as  provided  by  the 
pitch  SAS  rate  gyro,  is  utilized  to  augment  the  airplane  short  period  damping 
and  thereby  alleviate  the  excitation  of  short  period  induced  gust  loads  and  to 
restore  the  handling  qualities  degraded  by  the  aileron  pitching  moment  effects. 

An  existing  C-5  autopilot  subsystem  vertical  accelerometer  mounted  in  the 
forward  fuselage  provides  additional  gust  load  control  and  compensates  the  air- 
plane pitch  response  characteristics. 

A feedforward  signal,  pilot's  elevator  input  command,  is  required  to  re- 
store the  airplane  maneuverability  and  accelerated  stability  (stick  force  per 
•g’)  characteristics  that  are  significantly  degraded  by  the  load  control  sig- 
nals, This  signal  is  scheduled  as  a function  of  airplane  dynamic  pressure  and 
compensated  by  a command  model  filter  to  provide  the  proper  system  handling 
qualities  throughout  the  operational  envelope. 

These  three  signals,  pitch  rate,  normal  acceleration  and  pilot  elevator 
command  input  are  summed  and  again  scheduled  with  dynamic  pressure  and  passed 
through  system  cut-off  filters  for  stability  and  gust  load  control  phasing. 

The  elevator  signal  is  provided  to  a boundary  control  logic  network 
that  disengages  the  signal  under  the  same  conditions  as  the  aileron  channel. 
This  circuit  includes  a fade-out  filter  to  minimize  acceleration  transients 
resulting  from  abrupt  surface  disengagement.  The  command  signal  is  then  limit- 
ed and  interfaced  with  the  pitch  augmentation  subsystem. 


System  Changes 


The  functional  development  of  the  ALDCS  provided  the  usual  subsystem 
changes  which  caused  agonizing  perturbations  in  the  design  of  the  prototype 
subsystem  hardware.  These  modifications  of  the  mechanization  fall  into  the 
following  major  areas: 

® Wing  accelerometer  location 

* Operational  flight  envelope 
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Subsystem  stability  - filter  compensation 


Wing  Accelerometer  Location  ~ 

Trade  studies  were  accomplished  to  determine  the  number  and  locations  of 
the  wing  mounted  accelerometers*  The  C-5  wing  locations  acceptable  to  sensor 
installation  are  essentially  limited  to  the  front  and  rear  beams  due  to  fuel 
tank  locations.  Original  studies  of  the  wing  aocelerometer  location  indicated 
the  need  for  two  sensors  per  wing,  one  on  the  mid-wing  aft  main  beam  and  one  in 
the  outer  wing  to  be  mounted  on  the  front  main  beam.  These  sensors  were  to  pro- 
vide "high  gain”  feedback  control  of  the  first  and  second  wing  flexible  bending 
modes.  Additional  studies  proved  the  ”high  gain”  system  design  to  be  impracti- 
cal and  that  the  second  wing  mode  did  not  contribute  significantly  to  gust 
loads,  thus  the  mid-wing  sensor  locations  were  eliminated*  This  removal  and 
relocation  of  the  outer  wing  front  beam  accelerometer  to  the  rear  beam,  caused 
a favorable  influence  on  subsystem  stability  and  allowed  the  maneuver  and  gust 
load  control  functions  to  be  simply  combined  with  reduced  gains  in  the  aileron 
channel. 

Later  a second  accelerometer  was  placed  incite  present  location  on  the 
front  beam  to  minimize  a 48  radian  per  second  outer  wing  coupling  mode  that,  in 
turn,  increased  the  stability  margins  and  eliminated  an  original  need  for  com- 
plex notch  filtering.  Figure  8 indicates  the  effect  of  single  and  blended  mul- 
tiple accelerometer  locations  on  the  ALDCS  aileron  closed  loop  frequency  re- 
sponse. The  rear  beam  sensor  permits  an  amplitude  gain  peak  of  7 db  at  48  rad- 
ians per  second.  The  addition  of  the  front  beam  accelerometer  adequately 
blended  with  the  rear  accelerometer  to  simulate  the  critical  48  radians  per  sec- 
ond node  location,  reduces  this  peak  to  approximately  one  db.  An  external 
wing  aocelerometer  installation  was  considered;  however,  the  additional  cost 
and  associated  design  risks  eliminated  this  design. 


Operational  Flight  Envelope  - 

To  insure  proper  functioning  of  the  ALLCS  throughout  the  required  flight 
envelope,  gain  scheduling  and  subsystem  disengagement  are  necessary.  The  orig- 
inal subsystem  mechanization  required  complex  nonlinear  scheduling  interfaces 
with  the  central  air  data  computer.  As  the  development  progressed  these  sched- 
ules were  simplified  to  linear  functions.  Also  an  original  ALDCS  requirement 
for  flaps  down  operation  was  deleted,  thereby  eliminating  the  need  for  flap 
gain  schedules  and  automatic  landing  interfaces.  These  functions  were  replaced 
by  a flaps  down  boundary  logic  control  disengagement  signal.  Another  change 
necessitated  by  flight  envelope  requirements  was  the  development  of  a fader  to 
smoothly  disengage  the  subsystem  when  the  airplane  exceeds  the  boundary  condi- 
tion of  normal  acceleration,  stall  approach,  and  speed/Mach.  Acceptable  hand- 
ling qualities  were  attained  at  these  boundary  conditions  with  a simple  track 
and  fade-out  circuit  in  the  elevator  channel. 
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Subsystem  Stability  - Filter  Compensation  - 

The  problem  of  subsystem  stability  followed  the  mechanization  development 
throughout  the  program  in  both  the  aileron  and  elevator  channels.  Perturbations 
in  the  mechanization  occurred  continually  with  the  altering  of  filter  compensa- 
tion, Ifejor  modifications  were  the  elimination  of  original  design  notch  filter- 
ing and  the  additions  of  simple  first  order  stability  filters  to  improve  a 2.4 
Hertz  stability  margin  in  the  aileron  channel  and  the  inclusion  of  a low, pass 
stability  and  fuselage  load  control  phasing  filter  in  the  elevator  channel. 


STJBSYSTffl  PERFOEMANCE 


The  ALDCS  as  mechanized  has  provided  the  load  alleviation  requirements 
without  signifioantly  interfering  with  airplane  stability,  handling  qualities, 
autopilot  performance  or  flight  safety.  The  performance,  as  discussed  in  the 
following  paragraphs,  has  been  obtained  utilizing  existing  C-5  aileron  and  in- 
board elevator  control  surfaces,  without  modification  to  the  primary  servo- 
actuators. 


Maneuver  and  Gust  Loads 


The  resulting  ALDCS  maneuver  and  gust  loads  performance  data  are  summariz- 
ed in  figures  9 through  12.  These  performance  results  indicate  that  the  incre- 
mental load  relief  meets  the  design  criterion  of  attaining  30  percent  bending 
moment  reduction  at  the  wing  root,  while  not  exceeding  five  percent  torsional 
increase  during  continuous  turbulence  flight. 

The  steady  maneuver  incremental  wing  root  load  per  *g’  ratios  of  ALDCS 
on  to  the  basic  aircraft  are  presented  in  figure  9*  This  summary  covers  a 
typical  cruise  payload  configuration  of  160,000  pounds  and  94 » 250  pounds  of 
fuel  for  a variation  of  Mach  number  and  altitude.  With  ALDCS  operative,  these 
results  indicate  inner  wing  load  reductions  of  32  to  52  percent.  The  basic  de- 
sign goal  ratio  of  0,70  was  achieved  for  all  configurations  within  the  normal 
C-5  operational  speed,  altitude  and  payload  flight  envelopes. 

A typical  wing  root  bending  moment  gust  frequency  response  and  PSD  output 
spectrum  are  shown  for  the  airplane  with  and  without  ALDCS  in  figure  10.  The 
ALDCS  gust  output  spectrum  is  significantly  reduced  from  that  of  the  free  air- 
plane. The  transfer  function  shows  that  the  first  vertical  wing  bending  mode 
amplitude  at  0.9  is  reduced  to  approximately  one-half  with  ALDCS  operative. 
ALDCS  control  bandwidth  encompasses  primarily  the  short  period  and  first  wing 
bending  aii^jlane  modes  through  the  frequency  of  approximately  one  Hg. 

Wing  root  RMS  bending  and  torsional  moment  ratios  of  ALDCS  on  to  ALDCS 
off,  for  a variation  of  altitude  and  Mach  numbers,  are  given  in  figures  11  and 
12.  The  ALDCS  reduces  the  RMIS  wing  root  bending  moments  by  30  to  50  percent  of 
the  free  airplane  without  increasing  the  torsional  moment  by  more  tnan  the  de- 
sign goal  of  5 percent  for  any  case.  The  torsional  moment  is  less  than  that  of 
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the  basic  airplane  for  the  majority  of  flight  cases  investigated 


Loads  criteria  for  discrete  gust  were  only  specified  to  the  extent  that 
the  ALDCS  shall  not  increase  the  basic  airplane  discrete  gust  loads.  Seven 
flight  cases,  similar  to  those  presented  in  figure  9f  were  analyzed  for  the 
"1 -cosine"  discrete  gust  model.  The  wing  root  bending  moment  peaks,  with 
ALDCS  on,  were  reduced  to  values  ranging  from  78  to  52  percent  of  the  free  air- 
plane for  the  critical  gust  frequency  wavelengths. 

Although  no  criteria  were  established  for  abrupt  maneuver  load  control, 
analyses  were  conducted  to  evaluate  the  effect  of  AL3X3S  on  abrupt  maneuver  load 
control  characteristics.  These  analyses,  conducted  for  seven  selected  flight 
conditions,  revealed  that  the  load  reduction  was  from  one  to  seventeen  percent 
depending  upon  the  particular  flight  case  response  characteristics.  In  an  ef- 
fort to  improve  this  performance,  a feedforward  pitch  control  command  signal 
was  provided  to  the  aileron  channel.  Results  of  analysis  with  the  aileron 
feedforward  signal  for  a selected  number  of  cruise  flight  conditions  indicated 
that  the  wing  root  bending  moments  could  be  reduced  by  30  percent  of  the  basic 
airplane.  This  feedforward  signal  mechanization  was  then  incorporated  in  the 
ALDCS  prototype  system  for  flight  test  evaluation. 

Fuselage  loads  performance  was  monitored  during  the  continuous  turbulence 
analysis  to  evaluate  the  effects  of  ALDCS.  Results  indicated  that  the  aft 
fuselage  bending  moments  were  being  increased  up  to  15?S  over  the  free  airplane. 
A low-pass  filter  was  added  to  the  elevator  channel  that  increased  stability 
margins  and  decreased  the  aft  body  fuselage  bending  moments  below  those  of  the 
basic  airplane  for  all  cases. 


Stability 


The  concern  that  the  ALDCS  possess  adequate  stability  gain  and  phase 
margins  caused  considerable  design  optimization  attention.  This  require- 
ment was  accomplished  as  indicated  in  figures  15  and  14*  These  gain  and  phase 
margins  represent  a series  of  reserve  fuel  loading  cases  that  inherently  pos- 
sess the  minimum  aileron  loop  stability.  The  elevator  loop  stability  is  mini- 
mum with  a high  fuselage  cargo  loading,  but  in  no  cases  were  the  phase  margins 
less  than  64  degrees  or  the  gain  margins  less  than  10  db. 

The  gain  margins  for  both  aileron  and  inboard  elevator  channels  are  well 
above  the  minimum  requirement  of  6 db  for  all  cases. 

The  only  flight  case  found  to  have  the  minimum  phase  margin  of  45  degrees 
was  that  of  a high  altitude,  reserve  fuel  and  maximum  ALDCS  operational  Mach 
number  of  0.825.  As  fuel  weight  is  added  to  this  oonfiguration,  the  aileron 
gain  and  phase  margins  are  increased.  A fuel  capacity  of  approximately  30 
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percent  for  this  case  has  a gain  margin  of  16.5  db  and  a phase  margin  of  62  de- 
grees . 


Minimum  aileron  gain  and  phase  margins  for  all  configurations  occur  at 
frequencies  between  35  to  55  radians  per  second  and  between  6 and  17  radians  per 
second,  respectively.  The  minimum  elevator  gain  margins  for  all  configurations 
occur  at  frequencies  between  6 and  8.6  radians  per  second  with  the  phase  margin 
frequencies  ranging  from  0,6  to  5»41  radians  per  second. 


Handling  Qualities 


A basic  ALDCS  design  goal  was  that  there  would  be  no  significant  degrada- 
tion of  the  existing  C-5  handling  qualities.  Extensive  analysis  and  pilot-in- 
the-loop  flight  simulation  evaluations  were  accomplished  to  insure  that  the 
ALDCS  was  compatible  with  the  C-5  flying  characteristics. 

The  handling  quality  areas  of  most  concern  that  could  be  altered  or  sig- 
nificantly degraded  by  the  ALDCS  were: 

® Maneuver  response 

° Accelerated  stability-stick  force  per  'g' 


° Short  period  stability 


® Phugoid  stability 
® Roll  performance 

Development  of  an  ALDCS  elevator  channel  pilot  command  model  filter  was 
essential  to  retain  the  C-5  maneuver  response  and  stick  fcrce  per  'g*  character- 
istics. ALDCS  short  period  and  phugoid  stability  effects  were  compensated  by 
appropriate  system  gain  and  filter  parameter  optimization.  The  roll  performance 
effect  was  greatly  reduced  by  using  the  minimum  aileron  channel  gain  schedule  re- 
quired for  maneuver  load  control. 

The  time  histories  shown  in  figure  I5  present  the  effects  of  ALDCS  on  air- 
plane normal  C.G,  acceleration  and  pitch  rate  responses  for  a typical  pull-up 
maneuver.  The  input  forcing  function  for  this  maneuver  is  a constant  control 
force  rate  and  hold  after  5 seconds.  This  figure  shows  that  the  time  to  obtain 
steady-state  maneuver  values  are  practically  the  same  with  ALDCS  off  or  on.  The 
only  difference  with  ALDCS  on  is  that  of  a slight  undershoot  in  peak  pitch  rate 
and  a slight  rise  time  improvement  to  acquire  the  steady  state  response.  Simu- 
lator pilot  evaluations  of  these  type  maneuvers  indicated  no  degradation  in  air- 
plane handling  quality  perfoirmance. 

The  longitudinal  axis  accelerated  maneuvering  stability,  as  shown  in  fig^ 
ure  16,  was  not  significantly  impaired  by  the  ALDCS.  The  ALDCS  stick  force  per 
Vg*  values  are  well  within  the  demonstrated  boundaries  of  previously  extracted 
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flight  test  data  without  AL'DCS.  The  steady-state  elevator  command  model  gain 
was  optimized  to  provide  identical  stick  force  per  *g*  characteristics  for  mid 
C.G.  flight  configurations  with  ALDCS  on  or  off.  Pitch  column  force  required 
to  hold  a given  acceleration  for  forward  and  aft  C.G.  with  ALDCS  on  are  slight- 
ly decreased  and  increased,  respectively  from  the  basic  airplane.  The  simulat- 
or pilots  were  unable  to  distinguish  these  ALDCS  oharaoteristics  from  those  of 
the  basic  airplane. 

No  short  period  and  phugoid  stability  damping  degradation  was  noticed 
during  the  development  flight  simulation  program  and  analytical  results,  as 
presented  in  figures  I7  and  18,  confirm  the  pilot  evaluations.  The  original 
basic  C-5  short  period  damping  requirement  for  the  cruise  configuration  was 
that  it  shall  damp  to  one-tenth  amplitude  within  one  cycle.  This  requirement 
has  been  exceeded  by  the  basic  airplane  and  is  slightly  more  damped  with  ALDCS 
operative. 

The  phugoid  m.ode,  as  shown  in  figure  18  exhibits  sufficient  stability, 
although  the  frequency  is  slightly  reduced  from  that  obtained  from  previous 
flight  test  data  correlation  studies.  The  original  C-5  phugoid  stability  re- 
quirement was  that  if  the  period  is  less  than  15  seconds,  then ' this  mode  shall 
be  at  least  neutrally  stable.  Data  shown  in  figure  18  does  not  indicate  any 
frequencies  with  periods  less  than  approximately  65  seconds  with  ALDCS  on. 

liiere  was  a concern  early  in  the  development  program,  that  the  ALDCS 
would  reduce  the  C-5  roll  performance.  This  concern  arose  primarily  due  to 
symmetrical  control  of  ailerons  with  high  acceleration  gains  that  may  cause 
actuator  saturation.  Theoretically,  there  is  a alight  decrease  in  available 
roll  power  due  to  aileron  saturation;  however,  flight  simulation  evaluations 
determined  that  the  pilots  could  not  detect  this  degradation.  For  maximum  roll 
rate  maneuvers,  the  simulation  pilots  would  mask  ALDCS  effects  by  commanding 
ailerons  for  a slight  additional  amount  of  time  to  perform  the  same  maneuver. 

The  following  handling  qualities  pilot  opinions  were  attained  during  the 
ALDCS  development  and  prototype  Vehicle  System  Simulation  Program. 

® Ease  of  trimming  to  new  speed  - no  degradation. 

® Phugoid  and  short  period  damping  - no  degradation. 

® Roll  power  - no  noticeable  degradation. 

® Stick  force  per  'g'  characteristics  - no  degradation. 

® ALDCS  fails  to  switch  off  - no  degradation  with  flap  extension. 

A total  of  six  pilots,  including  two  from  the  Air  Force,  flew  the  develop- 
ment simulator  with  ALDCS  on  and  off. 

The  effect  of  ALDCS  on  the  C-5  handling  qualities  can  be  summarized  by  the 
fact  that  the  simulation  pilots  were  unable  to  detect  whether  the  ALDCS  was  on 
or  off  during  evaluations  within  the  normal  flight  envelope. 
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Autopilot  Compati'bility 


The  ALDCS  is  designed  to  he  engaged  during  autopilot  operation,  thus  con- 
siderable design  attention  was  directed  to  subsystem  compatibility.  This  de- 
velopment was  concentrated  on  autopilot  interface  stability,  response  perform- 
ance and  flight  safety.  It  was  found  necessary  that  the  ALDCS  elevator  channel 
control  signals  of  pitch  rate  and  pilot’s  feedforward  command  be  disengaged 
during  autopilot  operation.  Elimination  of  these  oontrol  signals  during  auto- 
pilot operation  improved  the  stability  margins  and  minimized  control  wheel 
steering  sensitivity,  and  airplane  acceleration  response  due  to  an  autopilot 
hardover  failure. 

Results  indicate  no  apparent  degradation  in  either  stability  or  response 
of  the  autopilot  attitude,  altitude  hold  or  oontrol  wheel  steering  modes.  The 
effect  of  ALDCS  on  autopilot  altitude  hold  and  roll  performance  was  insignifi- 
cant with  the  airplane  achieving  limit  bank  angle  with  minimum  altitude  loss. 
Pitch  autopilot  hardover  failures,  with  ALDCS  engaged,  yield  a normal  acceler- 
ation response  slightly  below  that  of  the  basic  airplane  and  autopilot. 


Plight  Safety 


To  insure  that  ALDCS  faults  would  not  affect  the  C-5  flight  safety, 
failure  effects  analysis  and  prototype  vehicle  system  simulation  evaluations 
were  accomplished.  These  failures  involved  loss  of  ALDCS  sensor  signals,  loss 
of  ALDCS,  hardovers  of  sensors  and  channel  loop  commands,  gain  schedule  fail- 
ures, and  various  stability  augmentation  subsystem  (SAS)  failures  that  could 
be  effected  by  the  ALDCS, 

The  analysis  and  simulator  testing  indicates  that  the  ALDCS  adequately 
meets  the  safety  requirements  and  criteria.  There  is  sufficient  subsystem 
stability  should  any  one  sensor  or  channel  in  the  ALDCS  be  lost.  Neither  of 
the  various  SAS  failures  were  worse  than  those  of  the  existing  system;  however, 
some  failure  detection  and  airplane  transient  improvement  was  exhibited  with 
ALDCS  operative. 

Results  of  these  studies  indicated  that  there  were  no  single  ALDCS  or 
automatic  flight  oontrol  interface  failures  that  caused  pilot  concern.  Ade- 
quate fault  detection  and  annunciation  of  these  failures  was  apparent  to  the 
pilot.  The  ALDCS  has  met  the  basic  safety  criteria  and  is  acceptable  for 
prototype  development  flight  testing. 

Ride  Control 


No  real  attempt  was  made  during  the  ALDCS  development  program  to  improve 
the  G-5  ride  control  characteristics.  The  pilot's  station  acceleration  levels 
were  monitored  throughout  the  continuous  turbulence  analysis  however,  to  in- 
sure that  the  ride  quality  was  not  adversely  affected  by  the  ALDCS, 
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Results  of  these  analyses  revealed  that  the  pilot’s  acceleration  levels 
were  reduced  by  7 to  55  percent  throughout  the  C-5  ALDCS  flight  envelope. 


CONCLUDING  REMARKS 


A prototype  maneuver  and  gust  load  alleviation  control  system  has  been 
successfully  developed,  fabricated  and  simulator  tested  meeting  demanding 
schedules  and  functional  requirements.  It  is  felt  that  a major  airplane  ac- 
tive control  subsystem  integration  accomplishment  has  been  achieved  by  inte- 
grating the  ALDCS  into  the  total  C-5  Vehicle  System  while  maintaining  compat- 
ibility with  existing  airplane  stability,  handling  qualities,  and  flight  con- 
trol subsystems.  V/hile  no  specific  requirements  were  established,  it  is  note- 
worthy that  the  ALDCS  has  favorably  influenced  the  pilot  station  accelerations 
(ride  control),  abrupt  maneuver  load  control,  aft  fuselage  gust  loads,  and  some 
failure  detection  levels  of  interfacing  automatic  flight  control  subsystems. 

Now  as  the  Active  Lift  Distribution  Control  Subsystem  enters  development 
flight  test  evaluations  the  development  engineers  and  the  design  personnel 
from  the  affected  disciplines  oonfidently  feel  that  the  subsystem  will  continue 
to  meet  its  design  objectives.  These  design  engineers  have  integrated  their 
experience,  development  techniques,  and  computer  programs  to  meet  a very  re- 
strictive schedule.  The  success  of  this  development  program  can  largely  be 
attributed  to  the  fact  that  the  prototype  systems  were  primarily  designed  and 
fabricated  within  the  structure  of  one  company. 

It  is  planned,  if  successful  in  flight  test,  that  the  ALDCS  be  produced 
and  retrofitted  to  the  C-5  fleet.  This  ALDCS  development  program,  even  though 
it  is  not  a true  preliminary  design  application  of  active  control  technology, 
has  provided  an  understanding  of  the  problems  facing  the  designer  and  the  ex- 
perience and  design  techniques  needed  to  apply  active  controls  to  aircraft  of 
the  future. 
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LIFT  DISTRIBUTION 


WING  SEMISPAN 


Figure  1,-  Effect  of  aileron  control  on  C-5 
wing  lift  distribution. 


Figure  2,-  C“5  AliDCS  development  program 
flow  diagram* 
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Figure  5,-  c-5  ALDCS  speed  altitude  envelope. 
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Figure  AIJ)CS  flight  control  system  interface  diagram* 
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Figure  6.-  C-5  ALDOS  major  airplane  components  interface. 


344 


REPBODUGBILrrY  OF  THE 
FAOE  IS  POOR 


PITCH 

COLUMN 

SIGNAL 

POSITION 

(ECPI 

FILTER 

^ — _ _ 

. — . 

NORMAL  1 

ACCELERATION  ! 
RIGHT  WING  ^ 
FRONT  BEAM 

GAIN 

AND 

1 NORMAL 

FILTER 

1 

H.Q, 

COMMAND 

MODEL 

ACCELERATION  j 
LEFT  WING 
FRONT  BEAM 

NORMAL 
ACCELERATION 
RIGHT  WING 
REAR  BEAM 

NORMAL 
ACCELERATION 
LEFT  WING 
REAR  BEAM 


(ELEVATOR  CHANNEL) 


STABILITY  AND 
LOAD  CONTROL 
GAIN  AND 
FILTERING 


GAIN  • 
SCHEDULE 


STABILITY 

AND 

CUT-OFF 

FILTERS 


BOUNDARY 

LOGIC 

CONTROL 


(AILERON  CHANNEL) 


► SCHEDULED  GAINS  - 
DYNAMIC  PRESSURE 


AILERON 

ACTUATORS 


Figure  7.- 


C"5  ALDCS  simplified  functional 
block  diagram* 


Figure  8*»  C«5  ALDCS  aileron  closed-loop 
frequency  response* 
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TRANSFER  FUNCTION  - IN.  LB  X 10 


LOAD  RATIO  - 


FUEL  WEIGHT  94,250  LB 
CARGO  WEIGHT  160,000  LB 


i’igure  11,  - C-5  ALDCS  wing  root  gust  EMS 
bending  moment  ratio. 


FUEL  weight  94,250  LB 
CARGO  WEIGHT  160,000  LB 


Figure  12,  - C-5  ALDCS  wing  root  gust  RMS 
torsion  moment  ratio 
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CRUISE  SUMMARY 


Figure  16,-  C-5  ALBCS  maneuvering  longitudinal  axis 
stability  - Stick  force  per  g. 
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ACTIVE  CONTROLS  FOR  RIDE  SMOOTHING 


D.  William  Conner 
NASA  Langley  Research  Center 

and 

Glenn  O.  Thompson 
The  Boeing  Company , Wichita  Division 

IKTRODUCTION 

Active  controls  technology  offers  great  promise  for  significantly 
smoothing  the  ride,  and  thus  improving  public  and  air  carrier  acceptance,  of 
certain  types  of  transport  aircraft.  Recent  findings  which  support  this 
promise  will  be  presented  in  the  following  three  pertinent  areas: 

1.  Ride  q.uality  versus  degree  of  traveler  satisfaction 

2.  Significant  findings  from  a feasibility  study  of  a ride 
smoothing  system 

3.  Potential  ride  problems  Identified  for  several  advanced  transport 
concepts 


RILE  QUALITY  AMD  TRAVELER  SATISFACTION 


Aircraft  Motion  Characteristics 

Large  differences  in  ride  smoothness  can  exist  for  transport  aircraft  as 
illustrated  in  figure  1,  where  levels  of  vertical  acceleration  are  presented 
for  three  vehicles  as  a function  Of  percent  time  that  acceleration  levels  are 
exceeded.  The  data  shown  for  airplanes  A and  B are  averaged  values  of 
measurements  obtained  in  the  passenger  compartment  about  every  2 minutes 
between  takeoff  and  landing  during  many  flights  onboard  schediiled  passenger 
service  in  the  eastern  seaboard  region  of  the  United  States, 

For  airplane  C,  data  from  which  averaged  values  were  obtained  are  much 
more  limited,  but  are  considered  representative  of  cruise  flight  conditions 
for  present-day  large  jet  transports.  Table  I lists  approximate  values  of 
several  factors  for  the  aircraft  believed  to  influence  the  levels  of  vertical 
response.  Acceleration  levels  for  airplane  C are  favorably  minimized  by 
high  wing  loading,  by  wing  sweep,  by  low  tail  volume  coefficient,  and  by  higb 
cruise  altitude.  For  the  two  smaller  aircraft  which  bave  somewhat  similar 
properties,  the  vertical  acceleration  levels  for  airplane  B are  significantly 
lower  than  for  airplane  A,  probably  because  of  the  higher  cruise  altitude  of 
these  studies.  The  question  arises  as  to  how  to  interpret  data  such  as 
presented  in  figure  1 in  terms  of  passenger  satisfaction.  Before  design  goals 
can  be  established  for  application  of  active  controls  to  ride  smoothing, 
information  is  needed  concerning  the  influence  of  ride  quality  on  traveler 
acceptance  and  use  of  vehicles. 
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Comfort  Factors  and  Criteria 


Subjective  response  to  motion  has  been  studied  in  some  detail  to  establish 
tolerance-limit  criteria  (e.g.,  ability  to  perform  a specific  task  under  adverse 
environmental  conditions , exposure-time  limit  allowable  in  a high-vibration 
environment,  etc.).  In  the  area  of  the  ride  comfort,  which  involves  much  lower 
magnitude  motions,  meaningful  information  is  limited  and  criteria  are  not  well 
established.  To  fill  a need  in  this  area,  NASA  has  under  way  considerable 
research  concerning  ride  quality  and  traveler  satisfaction.  The  effort  described 
in  reference  1 involves  both  field  measurements  to  identify  important  factors 
(e.g. , motion,  vibration,  etc.)  and  to  develop  approximate  criteria,  and 
laboratory  and  research  aircraft  experiments  under  closely  controlled  conditions 
to  establish  a good  understanding  of  all  factors  involved.  Much  of  the  field 
measurement  effort  has  been  carried  out  as  part  of  a traveler  acceptance  study 
by  the  University  of  Virginia  under  NASA  grant.  The  study  with  some  of  the 
findings  is  decribed  in  reference  2.  Information  from  that  part  of  the  study 
which  addresses  motion  environment  and  passenger  response  will  be  used  in  the 
next  few  figures  to  illustrate  how  evaluation  can  be  made  of  the  ride  quality. 

The  study  also  provided  the  data  for  figure  1. 

During  flights  on  air  carriers  and  research  aircraft,  simultaneous 
recordings  were  made  of  reactions  of  test  subjects  as  well  as  of  aircraft  motion 
environment  in  all  six  degrees  of  freedom.  Correlation  of  extensive  data  from 
a number  of  differenct  aircraft  indicated  that  ride  comfort,  while  influenced 
by  many  factors,  is  particularly  affected  by  vertical  and  lateral  accelerations. 
Based  on  just  these  two  factors,  initial  criteria  have  been  developed  of 
passenger  ride  comfort  response.  These  criteria  are  presented  in  figure  2. 

Lines  of  approximately  equal  comfort  rating  are  shown  as  a function  of  lateral 
and  vertical  acceleration.  A five-unit  descriptive  scale  of  comfort  rating  was 
employed  with  terms  ranging  from  Very  Comfortable  to  Very  Uncomfortable.  Test 
subjects  were  about  twice  as  sensitive  to  lateral  accelerations  as  to  vertical 
accelerations.  In  figure  3,  acceleration  values  measured  onboard  airplane  A 
are  superimposed  on  the  same  scale.  Of  a total  of  409  points,  25  points,  which 
correspond  to  6 percent,  lie  in  the  zone  between  Very  Uncomfortable  add 
Uncomfortable.  An  additional  46  percent  falls  in  the  region  between  Uncomfort- 
able and  Neutral.  Thus,  more  than  one-half  the  time,  passengers  could  be 
expected  to  rate  the  ride  as  significantly  less  than  Comfortable.  Ride  rating, 
however,  does  not  tell  the  whole  story.  In  surveys  of  passengers  made  at  the 
end  of  trips,  many  passengers  indicated,  even  after  a ride  rated  as  Uncomfort- 
able, willingness  to  repeat  the  same  trip.  Figure  4 presents  these  results 
expressed  as  the  variation  in  overall  trip  ride  comfort  rating  with  percent  of 
passengers  satisfied.  For  this  figure,  the  word  "satisfied"  is  defined  as 
willingness  expressed  by  the  passenger  to  buy  another  ticket  on  the  same 
aircraft  and  to  experience  the  same  ride.  As  would  be  expected,  passenger 
satisfaction  decreases  substantially  as  the  ride  becomes  progressively  less 
comfortable,  until  only  25  percent  were  satisfied  for  a ride  rated  as  Very 
Uncomfortable.  Thus,  passenger  satisfaction  can  be  related  to  ride  comfort, 
which  in  turn  can  be  related  to  the  vertical  and  lateral  acceleration 
environment. 
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Satisfaction  Assessment  of  Aircraft 


Figiire  5 presents  estimated  traveler  satisfaction  characteristics  derived 
from  vertical  and  latereQ.  acceleration  data  for  the  three  aircraft  discussed 
previously.  Satisfaction  is  expressed  in  terms  of  percent  travelers  satisfied 
as  a function  of  flight  time  percentile  ranked  by  ride  smoothness,  with  the 
smoothest  periods  of  flight  occurring  at  0 percentile,  and  the  roughest  periods 
at  100  percentile.  The  term  "traveler"  is  used  rather  than  "passenger"  to 
point  out  that  about  5 percent  of  all  travelers  will  not  be  satisfied  in 
riding  an  aircraft  no  matter  how  smooth  the  ride  may  be.  For  this  reason, 
airplane  C,  which  is  considered  to  have  excellent  ride  characteristics  when 
cruising  in  smooth  air,  is  shown  to  be  satisfactory  under  the  best  of  conditions 
to  only  95  percent  of  all  travelers.  For  this  aircraft,  the  ride  quality 
continues  to  be  quite  favorable  to  the  90-percentile  time  point  where  about 
90  percent  of  all  travelers  would  be  satisfied.  In  contrast,  airplane  A would 
be  satisfactory  to  only  50  percent  of  all  travelers  at  the  90-percentile  time 
point  and  to  slightly  less  than  80  percent  of  all  travelers  at  the  50-percentile 
time  point.  ’While  the  trends  indicated  are  considered  significant,  a note  of 
caution  needs  to  be  interjected  concerning  the  simplistic  approach  used  to 
estimate  traveler  satisfaction.  Actually,  there  are  a number  of  factors  other 
than  vertical  and  lateral  acceleration  known  to  influence  ride  quality  to  some 
degree.  Examples  include  disturbances  in  rolling  motion,  terminal-area 
maneuvers,  visual  cues,  cabin  temperature,  and  seat  size.  As  more  is  learned 
in  studies  concerning  these  factors,  the  approach  just  described  for  estimating 
satisfaction  can  be  refined  to  provide  more  precise  evaluations. 


Considerations  for  Application  of  Ride-Smoothing  System 

The  trends  shown  in  figure  5 indicate  that,  in  terms  of  traveler 
satisfaction,  the  relative  improvement  possible  by  addition  of  an  active- 
control  system  would  be  more  modest  for  airplane  C than  for  either  airplane  A 
or  B.  In  addition  to  information  as  shown  above,  a decision  to  incorporate  a 
ride-smoothing  system  into  an  aircraft  involves  a number  of  other  considerations. 
Questions  such  as  the  following  three  are  examples: 

What  is  the  ride-environment  conditioning  of  the  passengers  who 
will  be  using  the  aircraft?  For  residents  in  undeveloped  regions, 
the  ride  of  a DHC-6  could  be  a big  improvement  over  the  ride  of  an 
off-road  mode  of  transportation,  while  for  residents  of  a metropolitan 
area,  seasoned  by  smooth  rides  on  long-range,  heavy  aircraft,  equally 
good  rides  coxild  be  expected  of  smaller  short— havil  aircraft  used  by 
the  connecting  feeder  lines. 

Will  increase  in  revenue  from  additional  travelers  gained  by 
ride  smoothing  offset  the  increased  costs  of  the  active-control 
system?  Carriers  serving  low-density  markets  may  generate  little, 
if  any,  additional  business  by  ride  smoothing,  whereas  air  carriers 
serving  high-density  markets  may  generate  considerable  extra  revenue 
by  attracting  customers  from  competitors  whose  aircraft  have  a 
poorer  ride. 
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Is  there  a public  responsibility  to  make  the  ride  acceptable  to 
the  greatest  possible  number  of  travelers?  Perhaps  carriers 
serving  the  public  should  be  obliged  to  conform  to  minimum 
comfort  standards  as  well  as  to  requirements  concerning  safety 
or  to  the  amount  of  service  given  cities  on  their  route  structure. 

Answers  to  the  above  questions  will  depend  to  a significant  degree  on  detailed 
infojnnation  on  the  active- control  systems  required  for  ride  smoothing. 


RIDE-SMOOTHING  SYSTEM  FEASIBILITY  STUDY 


Concurrent  with  subjective  studies  of  ride  quality,  a feasibility  study 
was  carried  out  of  an  active-control  system  fox  the  de  Havilland  DHC-6  aircraft 
for  NASA  by  the  Wichita  Division  of  The  B6eing  Company  assisted  by  de  Havilland 
Aircraft  of  Canada,  Limited*  The  objective  was  to  examine  the  feasibility  of 
developing  and  certificating  a ride-smoothing-control  system  for  a typical 
small  feeder  line  aircraft  known  to  have  a ride  environment  not  equal  to  that 
found  on  larger,  high-wing-loading  jet  transports.  The  DHC-6  was  selected  for 
study  not  only  because  it  has  a low  wing  loading  and  is  oftentimes  operated 
extensively  in  low-altitude  turbulence,  but  also  because  it  is  the  only  STOL 
vehicle  presently  certificated  and  extensively  used  by  air  carriers  in  this 
country.  Its  capability  to  carry  out  steep-angle  cllmbouts  and  descents  and 
to  perform  short-radius,  terminal-area  maneuvers  makes  suitable  the  study  of 
ride-quality  situations  reasonably  typical  of  those  which  may  be  encountered 
by  subsequent  advanced  STOL/RTOL  transports.  An  example  application  of  this 
nature  is  the  Canadian  STOL  Demonstration  Program  between  Ottawa  and  Montreal, 
where  modified  DHC-6  aircraft  are  being  used  to  obtain  passenger  acceptance 
data  as  well  as  to  study  and  refine  Systems  operations  in  advance  of  intro- 
duction of  the  new  and  larger  DHC-7  STOL  transport  aircraft  now  being  built 
for  such  service. 


Description  of  System  Studied 

Quite  a bit  of  information  having  general  application  to  ride-smoothing 
systems  was  obtained  from  the  feasibility  study.  Highlights  of  this  general 
information  will  be  presented  herein;  detailed  description  of  the  study  and 
findings  are  presented  in  reference  3.  Investigation  of  active  controls  was 
limited  to  only  vertical  and  lateral  ride  smoothing,  as  preliminary  study 
indicated  response  to  turbulence  to  be  acceptably  low  for  the  other  degrees  of 
freedom.  The  aerodynamic  surfaces  considered  in  the  system  are  shown  in 
figure  6 and  include  portions  of  the  existing  ailerons,  elevators,  and  rudder 
as  well  as  all-new  spoilers.  Consideration  of  additional  surfaces  could  not 
be  accommodated  within  the  scope  of  the  study.  Ride  control  of  each  degree  of 
freedom  was  treated  independently.  Simplified  block  diagrams  showing  feedback 
loops  are  presented  in  figure  7 for  the  vertical  control  system  and  in  figure  8 
for  the  lateral  control  system.  Details  such  as  transfer  functions  are  not 
shown.  System  effectiveness  was  determined  as  reduction  of  acceleration 
response  to  a random  turbulence  intensity  with  an  exceedance  probability 
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of  0.01  which  was  established  as  a gust  velocity  of  2.1  meters  per  second 
(rms)  for  the  design  flight  conditions. 


Ride-Control  Effectiveness 

In  the  area  of  effectiveness,  the  most  important  finding  was  the  require- 
ment for  relatively  large  direct“lift  and  direct-side-force  surfaces  located 
near  the  airplane  center  of  gravity.  As  shown  by  the  bar  charts  of  figure  9, 
significant  reductions  in  vertical  acceleration  response  were  obtained  with 
wing  flaps  retracted  during  both  climb  and  cruise  conditions.  The  elevator 
surfaces  contributed  only  a modest  amount  to  this  reduction.  For  the  landing 
approach  condition,  new  spoilers  had  to  be  employed  to  even  achieve  the  less- 
than-adequate  reductions  shown.  Design  techniques  need  to  be  developed 'for 
integrating  large,  direct-lift  surfaces  for  ride  smoothing  into  wing-flap 
systems.  Use  of  rudder  surfaces  for  reducing  lateral  response  was  somewhat 
effective  in  the  aft  section  of  the  passenger  cabin,  but  was  ineffective  ahead 
of  the  cabin  midpoint.  Efficient  (high  side-force/drag)  direct  side- force 
surface  configurations  need  to  be  provided  at  a fore-and-aft  location  near 
the  airplane  center  of  gravity.  Some  technology  for  such  surfaces  was  generated 
in  the  development  of  the  General  Purpose  Airborne  Simulator  (GPAS)  and  the 
Total  In-Flight  Simulator  (TIPS)  research  aircraft. 


Aircraft  Stability,  Control,  and  Handling  Qualities 

In  this  area,  a ride-smoothing  system  can  be  designed  which  is  satisfactory. 
Considerable  attention  must  be  given,  however,  to  various  potential  problems 
in  order  that  the  system  be  tailored  to  minimize  adverse  effects.  In  the 
feasibility  study,  problems  which  had  to  be  resolved  involved  the  aircraft  low- 
frequency  longitudinal  mode,  the  very- low- frequency  phugoid  mode,  the  Dutch- roll 
mode,  and  the  lateral-directional  spiral  mode.  A detailed  control  system 
synthesis  and  performance  analysis  is  required  to  examine  various  trade  offs. 
During  the  study,  problems  also  had  to  be  resolved  in  aircraft  handling  qualities 
such  as  one  where  adding  the  active- control  system  caused  a loss  of  effectiveness 
of  the  elevator  to  relatively  sharp  inputs.  In  this  case,  satisfactory  short- 
period  handling  quality  was  achieved  by  introducing  a crossfeed  signal  to  the 
system  to  initially  cancel  the  ride-control  signal  which  opposed  the  acceleration, 
and  then  to  wash  out  at  the  same  rate  as  the  ride-control  signal.  Use  of 
ground  based  simulators  is  appropriate  to  study  and  help  resolve  handling 
problems . 


Reliability  and  Safety 

No  major  problems  in  reliability  are  anticipated  for  the  ride-smoothing 
system.  Since  use  of  the  system  is  not  critical  to  the  well  being  of  the 
aircraft,  the  system  can  be  deactivated  if  malfunctions  occur.  The  main 
concern  involves  transient  problems  which  could  arise  at  the  time  of  any 
malfunction.  The  worst  problem  envisioned  would  be  hard-over  deflection  of  an 
aerodynamic  surface  used  in  the  active-control  system.  If  sufficient  authority 
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is  provided  by  the  aircraft  control  system  to  control  vehicle  motions ■ caused 
by  such  a deflection,  safety  can  be  maintained.  Such  authority  would  be  a 
reasonable  requirement  for  system  .certification.  A fail-soft  design  control 
system,  such  as  devised  in  the  feasibility  study,  can  also  be  incorporated  for 
additional  protection.  The  particular  system  studied  contained  dual  signal 
channels  with  two  stages  of  monitoring  between  channels  for  failure  detection. 
An  unfavorable  comparison  of  channel  signals  would  switch  off  the  ride 
control  signals. 


System  Components 

Ride-smoothing  hardware  requirements  are  not  considered  to  tax  the  present 
state  of  technology.  Appropriate  sensors,  electronic  elements,  servosubsys terns , 
and  actuators  are  in  production.  The  size  and  capacities  of  these  components 
are  not  necessarily  matched  to  detailed  requirements,  and  modifications  of 
existing  designs  may  be  required  to  obtain  appropriately  tailored  articles. 
Aerodynamic  requirements  do  require  innovation,  as  discussed  earlier,  to 
develop  configurations  to  efficiently  produce  aerodynamic  forces  through  the 
center  of  gravity  in  both  vertical  and  lateral  directions. 


Weight,  Power,  and  Volume  Requirements 

Weight  and  power  demands  of  a ride-smoothing  system  should  not  seriously 
burden  the  aircraft.  Findings  of  the  feasibility  study  indicated  the  total 
additional  weight  would  amount  to  less  than  2 percent  of  the  aircraft  gross 
weight.  Additional  power  requirements  of  the  system  would  amount  to  no  more 
than  0.3  percent  of  the  aircraft  total  engine  power.  Requirements  for  larger 
aircraft  would  not  be  expected  to  exceed  these  percentage  values.  Only  a 
small  additional  volume  is  needed,  but  volume  requirements  in  local  regions 
near  aerodynamic  control  surfaces  may  require  special  consideration,  particularly 
if  an  existing  aircraft  is  being  retrofitted  with  a ride-smoothing  system. 


System  Costs 

Cost  information  is  lacking  because  no  detailed  cost  analysis  has  been 
carried  out.  Based  on  the  findings  presented  above,  system  development  and 
certification  will  require  considerable  effort  which  will  be  somewhat  inde- 
pendent of  aircraft  size.  Where  the  system  is  incorporated  into  the  initial 
design  of  an  all-new  aircraft,  the  additional^xosts  estimated  for  the  system 
design  through  prototype  flight  test's  "and  certification  could  range  from  2 to 
5 percent  of  the  total  costs.  The  additional  cost  would  be  expected  to  be 
higher  if  a system  were  to  be  designed  and  retrofitted  into  an  existing 
vehicle.  These  higher  costs  result  because  of  the  probability  of  significant 
modification,  requalification,  and  retesting  of  existing  systems  and  structures. 
Estimated  production  costs  for  the  system  in  terms  of  aircraft  production  cost 
could  range  from  about  1 percent  for  large  jumbo  transports  to  as  much  as 
4 or  5 percent  for  very  small  transports.  Ride  smoothing  may  be  included  as  a 
feature  of  a multipurpose  active-control  system  which  performs  other  functions 
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as  well,  such  as  gust-load  alleviation.  Design  and  checkout  of  an  appropriate 
multipurpose  system  would  require  considerable  effort,  possibly  greater  than 
the  sum  of  efforts  required  for  individual  systems. 


Maintenance  and  Repair 

Specific  maintenance  information  is  lacking  until  a ride-smoothing  system 
is  put  into  service.  Considerable  experience  has  been  obtained,  however,  on 
a closely  related  active-control,  fatigue-reduction  system,  described  in 
reference  4,  which  was  applied  to  the  United  States  Air  Force  B-52G  and  B-52H 
fleet  of  280  aircraft.  For  this  application,  system  performance  and  maintenance 
experience  has  been  excellent  and  well  within  guideline  limits.  Since  an 
active-control,  ride-smoothing  system  is  essentially  a state-of-the-art  system 
competitive  with  control  systems  used  on  modern  transport  aircraft,  maintenance 
should  be  similar  to  that  required  for  current  control  systems. 


Time  Required  for  System  Implementation 

Little,  if  any,  additional  time  would  be  needed  if  the  decision  to  proceed 
is  made  at  the  beginning  of  an  all-new  aircraft  project.  For  retrofit  of  a 
ride-smoothing  system  into  an  existing  aircraft,  the  total  time  required  is 
estimated  to  range  between  2 and  3 years. 


POTENTIAL  RIDE  PROBLEMS  FOR  ADVANCED  TRANSPORT  CONCEPTS 


A number  of  advanced  transport  concepts  are  in  various  stages  of  technology 
development.  Sufficient  information  is  presently  available  to  identify 
potential  problems  in  ride  quality  for  some  of  these  concepts.  Since  only  a 
qualitative  assessment  can  be  made  of  each  problem,  the  exact  role  to  be 
played  by  ride-smoothing  systems  cannot  be  exactly  defined  at  this  time.  A 
description  of  potential  problems  is  given  for  six  vehicle  concepts. 


Large,  Low-Wing-Loading  Aircraft 

One  attractive  concept,  described  in  reference  5,  for  achieving  STOL/RTOL 
capability  in  transports  for  medium-  to  high-density  market  short-haul  use, 
involves  the  combination  of  low-wing-loading,  mechanical-flap  configurations 
with  an  active- control,  gust-load  alleviation  system  to  minimize  structural 
weight.  Because  of  the  relatively  large  wing  area,  response  to  vertical 
gusts  can  be  expected  to  produce  a ride  which  is  less  than  satisfactory.  Use 
of  an  active-control  system  will  probably  be  required  not  only  for  gust-load 
alleviation,  but  for  ride  smoothing  as  well. 
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Powered-Lift  Aircraft 


Powered-lift  concepts,  which  involve  internally  or  externally  blown  flaps, 
can  produce  usable  maximum- lift  coefficients  of  two  to  three  times  those  for 
current  transports  as  described  in  references  6 and  7.  Such  high-lift 
capability  is  attractive  for  providing  STOL/RTOL  performance  with  high-wing- 
loading transports.  For  such  configurations,  engine-out  control  requirements 
will  probably  dictate  the  need  for  a relatively  large  vertical  tail  surface. 

Use  of  a large  tail  introduces  a potential  problem  of  uncomfortably  large 
responses  of  the  passenger  compartment  to  lateral  gusts.  Use  of  an  active- 
control  system  to  reduce  this  lateral  response  is  anticipated. 


Terminally  Configured  Vehicles 

Technology  is  being  developed  in  the  form  of  advanced  display  guidance 
and  control  systems  together  with  new  flight  paths  and  operating  techniques 
which  can  be  applied  to  advanced  aircraft  specifically  configured  to  more 
efficiently  use  the  airspace  in  terminal  areas  and,  thus,  help  relieve  airside 
traffic  congestion  Cref.  8).  The  flight  maneuver  techniques  are  anticipated 
to  involve  relatively  tight  turns  and  abrupt:  decelerations  which  could  introduce 
ride-quality  problems,  particularly  if  aggravated  by  oscillating  motions  of  the 
aircraft  due  to  air  turbulence.  In  order  that  the  maximum  degree  of  planned 
flight  maneuvers  can  be  utilized,  use  of  active- control  systems  may  be  required 
to  minimize  the  random  motion  environment. 


Supersonic  Aircraft 

The  need  to  achieve  efficient  operations  in  supersonic-cruise  flight  leads 
to  a configuration  requirement  for  long,  slender,  and  relatively  limber  fuse- 
lage configurations.  Use  of  such  configurations  is  anticipated  to  introduce 
problems  qf  motion  response  in  the  passenger  compartment  to  aeroelastic  inputs 
during  hi^h-speed  descent  from  cruise  altitude,  and  to  runway  roughness  inputs 
during  taxi,  take-off,  and  landing  rollout.  The  magnitude  of  motion  responses 
will  depend  on  the  fuselage  structural  dynamic  characteristics  and  can  be 
expected  to  vary  considerably  down  the  length  of  the  passenger  compartment. 
Problems  may  be  of  sufficient  magnitude  to  warrant  use  of  active-control 
systems  to  minimize  motion.  Solution  to  problems  could  lead  to  the  need  for 
a system  of  somewhat  unconventional  design. 


Civil  Helicopters 

Significant  effort  is  being  directed  toward  providing  advanced  technology 
for  large  civil  helicopter  transports  suitable  for  short-haul  operations. 

Based  on  experience  with  large  military  vehicles,  ride-quality  problems  can  be 
anticipated  from  oscillating  aerodynamic  inputs  associated  with  the  rotating 
blades.  These  inputs  result  in  vertical  and  lateral  responses  at  discrete 
frequencies  of  the  passenger  compartment.  The  need  for  an  active-control, 
rotor-feedback  system  to  reduce  responses  is  anticipated. 
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CONCLUDING  REMABKS 


A review  has  been  given  of  the  potential  use  of  active-control  systems 
for  ride  smoothing.  Substantial  differences  in  ride  quality  which  can  exist 
between  transport  aircraft  have  been  illustrated,  and  a technique  has  been 
described  for  assessing  these  differences  and  the  need  for  ride  smoothing  in 
terms  of  traveler  satisfaction.  Results  from  a ride  smoothing  feasibility 
study  have  been  used  to  provide  a generalized  assessment  of  active-control 
systems  for  this  purpose.  The  assessment,  which  includes  effectiveness, 
reliability,  maintainability,  and  costs,  indicates  that  no  major  technical 
problems  exist  and  that  significant  ride  smoothing  can  be  achieved  within 
the  present  state  of  the  art.  Evaluation  has  been  made  of  six  advanced 
transport  concepts  to  identify  potential  ride— quality  problems  and  possible 
requirements  for  active  controls.  The  next  major  step  indicated  for  advancing 
ride  smoothing  technology  is  system  application,  demonstration,  and  evaluation 
for  an  aircraft  in  regular  service. 
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Figure  4.  Relationship  between  comfort  rating  and  passenger  satisfaction. 
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Figure  6.  Active  control  surfaces  studied  on  DHC-6  aircraft* 
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USE  OF  ACTIVE  CONTROL  TECHNOLOGY  TO  IMPROVE 


RIDE  QUALITIES  OF  LARGE  TRANSPORT  AIRCRAFT 


Gerald  C.  Cohen,  Clifford  J.  Cotter,  and  Donald  L.  Taylor 
Boeing  Commercial  Airplane  Company 


SUMMARY 


This  paper  describes  the  analyses,  construction  and 
flight  testing  of  two  systems,  "Beta-vane"  and  modal 
suppression  augmentation  system  (MSAS)  ,>?  which  were  developed 
to  suppress  gust  induced  lateral  acceierations  of  large 
aircraft.  The  Boeing  747  transport  was  used  as  the  test 
vehicle.  The  purpose  of  the  Beta-vane  system  is  to  reduce 
acceleration  levels  at  the  "dutch  roll"  frequency  whereas 
the  function  of  the  MSAS  system  is  to  reduce  accelerations 
due  to  flexible  body  motions  caused  by  turbulence.  Data 
from  flight  test,  with  both  systems  engaged  shows  a 50-70 
percent  reduction  in  lateral  aft  body  acceleration  levels. 
Furthermore,  this  paper  suggests  that  present  day  techniques 
used  for  developing  dynamic  equations  of  motion  in  the 
flexible  mode  region  are  limited.  These  techniques  produce 
results  which  are  satisfactory  for  analyzing  dynamic 
loads  and  stability  problems,  but  may  be  insufficient 
for  development  of  active  control  systems  operating  in 
the  same  frequency  region. 


INTRODUCTION 


The  aft  fuselage  section  of  long  slender  airplanes 
is  a position  of  relatively  high  lateral  acceleration 
levels  in  moderate  to  heavy  turbulence.  These  accel- 
erations can  be  considered  as  being  due  to  contributions 
from  a rigid  airplane  with  the  elastic  effects  super- 
imposed. Initially,  because  of  the  experimental  nature 
of  the  program,  two  different  approaches  to  gust  alleviation 
were  undertaken.  One  system  worked  the  flexible  body 
frequencies  (MSAS  system  - Section  I)  whereas  the  second 
system  worked  primarily  rigid  body  frequencies  (Beta-vane 
system  - Section  II) . 


NOT  fUMSM 
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SECTION  I 


MODAL  SUPPRESSION  AUGMENTATION  SYSTEM  (MSAS) 


INTRODUCTION 


This  section  of  the  paper  will  describe  in  detail  the 
analysis/  construction  and  flight  testing  of  a modal 
suppression  augmentation  system.  This  system  was  designed 
to  reduce  aft  body  lateral  accelerations  in  the  1-3  Hz 
region  when  flexible  body  motions  are  perturbed  by  turbul- 
ence. Due  to  the  problems  associated  with  the  lateral 
dynamic  equations  of  motions  as  discussed  in  the  following 
section  (that  is /comparison  of  analytical  and  measured 
transfer-  functions  showed  a variation  in  the  flexible 
mode  region) , a technique  was  developed  which  involved 
'curve  fitting*  transfer  functions  to  experimental 
data.  This  method  then  allowed  a modal  suppression 
system  to  be  developed  without  dependence  on  the  analytical 
equations.  Furthermore/  by  including  the  yaw  damper 
actuator  with  the  experimental  data  that  was  analyzed  via 
the  curve  fit  method,  the  problem  associated  with  precise 
mathematical  modeling  of  the  structural  compliance  feed- 
back-actuator  system  was  avoided. 


COMPARISON  OF  ANALyTICAL  AND  EXPERIMENTAL  DATA 


Results  from  747  flight  testing  in  turbulence  indicated 
that  aft  end  lateral  motion  was  composed  of  the  following 
two  components; 

(1)  Rigid  Airplane  (dutch  roll)  — - 0,2  Hz 

(50%  contribution) 

(2)  Elastic  effects  — 1,0  - 3.0  Hz 

(50%  contribution) 

Within  the  1.0  - 3.0  Hz  band  of  frequencies  the 
analytical  equations  predict  five  free-free  modes, 
all  of  which  are  composed  to  some  degree  of  wing,  nacelle 
and  body  motions.  These  modes  (corrected  with  results  from 
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the  ground  vibration  test)  are  shown  in  Figure  1. 

Flight  test  data  reduced  via  the  'curve  fitting' 
technique  (explained  in  the  following  section)  is  also 
shown  in  Figure  1. 

Based  on  their  composition  the  modes  are  identified 
as  (1)  outboard  nacelle  vertical  bending,  (2)  fundamental 
wing  bending,  (3)  inboard  nacelle  side  bending,  (4)  aft 
body  bending,  and  (5)  outboard  nacelle  side  bending.  In 
addition  to  the  above  set  of  modes,  a stabilizer  mode 
at  3,16  Hz,  a fore  body  mode  at  4 Hz  and  a vertical  fin 
bending  mode  at  6 Hz  are  of  concern  in  conjunction  with 
the  development  of  the  MSAS  filter. 

Although  the  analytical  equations  were  reasonably 
close  to  measured  values  and  thus  sufficient  for  flutter 
studies,  the  development  of  an  active  control  system, 
however,  requires  not  only  that  the  characteristic  equation 
be  correct  but  also  that  the  residues  of  the  transfer 
function  (the  zeros  shown  in  Figure  1)  be  properly 
described . 

From  Figure  1,  it  is  seen  that  even  though  the  roots 
of  the  system  (poles)  are  identified  and  reasonably  close 
to  those  obtained  via  flight  test  data,  it  is  obvious  that 
the  associated  zeros  are  misaligned.  Various  attempts 
in  the  form  of  refinement  in  both  structural  and  aero- 
dynamic representation  did  not  succeed  in  changing  the 
general  picture.  Further  work  along  these  lines  still 
remains  to  be  pursued. 


As  a practical  solution  to  the  problem,  a curve 
fitting  technique  was  applied  to  the  measured  transfer- 
functions  to  identify  the  zeros  and  poles  of  the  system 
to  be  controlled. 


CURVE  FITTING  TECHNIQUE 


From  initial  experimental  data,  the  aft  body  was 
found  to  resonate  at  1,8  and  2.4  Hz  whereas  the  fundamental 
frequency  of  the  fore  body  was  4 Hz.  Furthermore,  the 
aft  body  could  be  perturbed  by  gusts  striking  the  fin  or 
gusts  exciting  the  engine  nacelles  producing  wing-body 
coupling  suggesting  that  either  the  ailerons  or  rudders 
could  be  used  for  the  active  control  system.  Due  to  the 
complexity  associated  with  developing  a system  in 
conjunction  with  the  ailerons,  a rudder  suppression 
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system  was  chosen.  Though  the  command  signal  to  the 
rudder  is  rate  limited  at  13  deg/sec  coiupared  to  a 50 
deg/sec  requirement  for  the  load  alleviation  system 
developed  for  the  B-52,  it  was  determined  that  this 
lower  rate  limit  would  satisfy  the  requirement. 

The  experimental  data  was  obtained  by  excitation 
of  the  lateral  airframe  degrees  of  freedom  in  the  1-7 
Hz  region  via  the  upper  and  lower  yaw  damper  servos  and 
their  respective  rudders.  The  forcing  function  itself 
was  a continuously  changing  constant  amplitude  sine  wave 
frequency  sweep,  in  the  1-7  Hz  range,  which  was  produced 
on  a computer  and  stored  on  magnetic  tape.  Using  the 
experimental  data  in  conjunction  with  a Fast  Fourier 
transform  data  reduction  package.  Bode  plots  for  various 
sensor  locations  on  the  aircraft  could  be  obtained. 

The  curve  fitting'  technique  is  based  on  the  2 papers 
given  in  references  1 and  2,  These  algorithms  were  pro- 
grammed on  the  CDC  6600  during  the  development  of  the 
Boeing  SST  and  were  used  in  the  design  of  3rd  and  4th 
order  prefilters  in  conjunction  with  the  Horowitz  Circle 
technique.  After  a few  attempts  at  deriving  transfer 
functions  from  the  experimental  data,  the  following 
deficiencies  in  the  computer  program  were  observed: 

1,  The  program  could  not  handle  14th  order  systems. 

2,  The  small  non-linearities  associated  with  the 
amplitude  and  phase  curves  were  sufficient  to 
make  the  computer  program  limit  cycle, 

3,  The  program  was  very  sensitive  to  end  point 
conditions , 

Transfer  functions  that  uiatched  the  experimental 
data  were  obtained  by  incorporating  the  following  procedures: 

1.  The  transfer  functions  were  assumed  to  be  of  minimum 
phase  (no  right  half  plane  zeros) . Therefore,  only 
the  amplitude  was  input  to  the  program. 

2.  A pole  or  pole-zero  combination  is  always  included 
on  either  side  of  the  band  of  frequencies  that  is 
of  interest. 
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The  transfer  functions  showed  clearly  that  although 
the  analytic  equations  could  be  manipulated  so  that  the 
modes  would  have  the  correct  frequencies,  the  zeros 
associated  with  these  analytic  equations  (and  therefore 
the  phase)  were  not  correct  for  the  2,1  and  2,4  Hz 
modes.  The  effects  of  the  different  zero  locations  on 
a control  system  will  now  be  shown, 

A root  locus  diagram  of  an  accelerometer  control 
system  based  on  the  analytical  equations  is  shown  in 
Figure  2,  The  control  system  adds  approximately  twice 
the  damping  to  the  2nd  and  4th  modes;  tnese  two  modes 
contribute  80%  of  the  flexible  energy.  This  system 
was  flight  tested  aud  results  showed  that  the  4th  mode 
was  destabilized  and  the  2nd  mode  increased  in  frequency 
as  the  gain  of  the  control  system  was  increased.  This 
same  control  systi^n  based  on  the  airplane  transfer  function 
obtained  via  the  curve  fit  computer  program  has  the  root 
locus  diagram  shown  in  Figure  3.  Notice  that  the  loci 
are  almost  the  same  as  those  obtained  in  flight.  This 
experimental  verification  of  the  curve  fit  technique  showed 
that  this  method  could  be  used  with  confidence. 

The  complete  design  technique  in  the  develojanent 
of  the  MSAS  is  the  following:  ’ 

1,  EXCITE  AIRPLANE  VIA  RUDDERS  - CONSTANT  AMPLITUDE 

SINE  WAVE  1,0  to  7,0  HZ, 

2,  CURVE  FIT  TRANSFER  FUNCTION  TO  AFT  BODY  SENSORS, 

3,  ROOT  LOCUS  METHODS  TO  DESIGN  FILTER, 

4,  EXCITE  AIRPLANE  VIA  RUDDERS,  WITH/WITHOUT  MSAS, 

TO  VERIFY  SUPPRESSION  OF  MODES, 

5,  FLY  MSAS  IN  TURBULENCE  TO  VERIFY  CONTROL  SYSTEM, 

Notice  that  this  procedure  does  not  allow  analytical 
verification  of  gust  suppression;  it  only  substantiates 
analytically  whether  the  control  system  adds  damping 
to  the  modes. 

Two  control  systems  were  designed  and  flight  tested 
using  the  above  procedure.  The  first  system  used  an  aft 
body  mounted  lateral  accelerometer  sensor  whereas  the 
second  system  used  two  yaw  rate  gyros,  one  aft  body  and 
one  at  the  eg.  Figure  4 shows  the  reduction  in  aft  body 
acceleration  (Body  Station  2300)  for  the  two  systems  when 
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the  sine  wave  forcing  function  is  fed  to  the  lower  rudder 
and  the  control  systems  are  commanding  the  upper  rudder. 
The  accelerometer  system  was  not  chosen  because  the  2,4 
Hz  mode  destabilized  at  high  'q*  conditions.  In  addition, 
to  obtain  equal  reduction  in  acceleration  levels  during 
turbulence,  the  accelerometer  system  required  more  rudder 
than  the  gyro  system  suggesting  that  the  gust  zeros  for 
the  two  systems  were  quite  different. 


DESCRIPTION  OF  FINAL  MSAS  SYSTEM 


The  MSAS  system  is  a single  channel  augmentation 
system  working  via  the  lower  yaw  damper  servo.  A block 
diagram  of  the  control  system  is  shown  in  Figure  5.  The 
augmentation  system  provides  damping  to  the  1.8,  2.1,  and 
2,4  Hz  aft  body  lateral  modes  without  disturbing  the 
dutch  roll  mode.  The  salient  features  of  the  system 
are  the  following: 

1.  Two  lateral  yaw  rate  gyros. 

2.  Single  channel  'real  time'  monitoring, 

3.  Scheduling  of  filter  gain  with  calibrated 
air  speed  (CAS) . 

4.  Output  of  system  limited  to  + 0.8  degrees 
of  rudder  (yaw  damper  authority  is  + 3,5 
degrees  of  rudder) . 

5.  Operation  of  system  limited  to  flaps  "up" 
condition. 


Figure  6 represents  a functional  block  diagram  of 
the  computational  path, 

1 . MSAS  Damping  Signal 

The  MSAS  signal  is  derived  from  the  subtraction  of 
two  yaw  rate  signals.  The  location  of  the  sensors 
are  the  following: 

a.  Aft  End  Gyro: 

Body  Station  2280,  WL190,  RBL20 
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b . CG  Gyro : 


Body  Station  1307,  WL195,  RBL5 


Due  to  the  placement,  the  aft  end  gyro  is  sensitive 
to  dutch  roll  and  flexible  mode  frequeneies  whereas 
the  eg  gyro  is  sensitive  only  to  dutch  roll  frequencies. 
Upon  subtraction  of  the  two  yaw  rate  signals,  the  remaining 
signal  contains  only  flexible  mode  frequencies. 


2,  Band  Pass  Filter 


At  flaps  up  condition,  the  yaw  rate  signal  passes 
through  a band  pass  filter  into  the  yaw  damper  servo 
amplifier.  The  band  pass  filter  is  corposed  of  R-C 
cOTponents,  operational  aitplifiers  and  multipliers. 

The  transfer  function  of  the  filter  can  be  expressed  in 
Laplace  form  as  the  following: 


750  KcasV  16S^\  / 14  ^ / 1.565^  + 9.4S  3ZQ\  / .726S\ 
^ S +50  /\^S  + 6)V  \S  + 14/  \ 5^  + 15.4 S + BZO  J \ 5+1  / 


A Bode  plot  of  the  filter  is  shown  in  Figure  7, 

The  functions  of  the  band  pass  filter  are: 

a.  To  wash  out  the  steady-state  yaw  rate  signals 
and  to  eliminate  null  offset  of  sensors, 

b.  To  reduce  high  frequency  signal  amplitudes  so 
as  to  minimize  coupling  with  the  higher  struc- 
tural modes, 

c.  To  obtain  the  proper  phasing  between  yaw  rate 
signal  and  lower  rudder  so  as  to  add  damping  to 
the  aft  body  lateral  flexible  modes. 


Figure  8 represents  the  transfer  function  of  yaw 
rate/lower  rudder  at  BS-2300  whereas  Figure  9 shows  the 
effects  of  the  MSAS  filter  on  the  above  dynamics.  The 
reason  for  the  complexity  of  the  filter  is  that  the  1,8 
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mode  required  'lag'  and  the  2.4  mode  'lead'  in  order  for 
the  system  to  add  the  maximum  damping  to  these  modes. 
Although  various  body  stations  were  investigated,  sensor 
positions  aft  of  the  eg,  along  the  floor  'water  line' 
showed  that  there  was  no  change  in  the  phase  relationship 
between  the  1.8  and  2,4  cps  mode. 

Figure  10  represents  a functional  block  diagram 
of  the  monitoring  system  and  pre-engage  mode.  The 
function  of  the  monitor  system  is  the  following: 

a.  Checks  the  principal  gains  and  phase  character- 
istics of  the  filter, 

b.  Detects  failure  of  either  gyro, 

c.  Detects  failure  of  the  limiter, 

d.  Detects  failure  of  gain  scheduler. 


The  purpose  of  the  pre-engage  mode  is  to  verify 
that  the  MSAS  electronic  unit,  including  monitor,  is 
operating  correctly. 


test  results 


A system  corresponding  to  the  filter  shown  in 
Figure  7 was  flight  tested  (no  monitor  system,  etc,). 

After  initial  calibration  and  stability  criteria  were 
satisfied  (6  db  gain  margin  and  60°  phase  shift) , the 
system  was  flown  in  turbulence.  Figure  11  shows  one 
of  the  many  time  histories  obtained.  Figure  12  represents 
the  cumulative  accelerations  for  the  time  history 
plots  of  Figure  11.  The  MSAS  system  reduces  the  aft 
body  flexible  mode  content  by  approximately  50%  (although 
Figure  12  shows  a 66%  reduction) . Figure  13  shows  the 
cumulative  acceleration  at  the  pilot  station.  It  may  be 
noted  that  there  is  very  little  1.8  and  2.4  Hz  content 
at  the  pilot  station  and  very  little  4 Hz  content  in  the 
aft  end. 

A production  type  unit  has  recently  been  flown 
(including  monitor  system,  etc.)  and  the  next  step  will 
be  to  certify  the  system  together  with  the  Beta-vane 
system.  The  combined  systems  will  then  be  installed 
on  a production  airplane  for  in-service  evaluation. 
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SECTION  II 


BETA-VANE  SYSTEM 


INTRODUCTION 


This  section  discusses  a method  devised  for  the  747 
airplane  of  reducing  tliose  accelerations  due  to  gust 
induced  rigid  airplane  motions.  As  was  pointed  out  in 
the  previous  section,  txie  level  of  RMS  accelerations  due 
to  turbulenee  is  approximately  50%  due  to  rigid  body 
motions  and  50%  due  to  flexible  motions  (Figure  14) . 
Consequently,  a system  designed  to  reduce  tlie  rigid 
body  accelerations  offers  only  half  the  potential  reduction 
in  the  total  level. 


SYMBOLS 

S vane  rotation 

Ug  longitudinal  body  axis  velocity 

Vg  lateral  body  axis  velocity 

Vp  total  velocity 

Wg  vertical  body  axis  velocity 

pQ  body  axis  roll  rate 

Rg  body  axis  yaw  rate 

longitudinal  distance  from 
C.G.  to  vane  station 

Hj  waterline  distance  from  airplane 
principal  axis  to  vane  station 
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Ay  accelerometer  output 
0 pitch  angle 
roll  angle 


METHOD  OF  SOLUTION 


The  method  used  for  gust  alleviation  on  the  747  in 
the  frequency  range  0 - 1 Hz  is  snown  in  Figure  15.  The 
basic  sensor  is  a relative  wind  vane  which  is  used  to 
sense  lateral  gusts;  the  output  of  the  vane  is  used  to 
drive  the  747  upper  rudder  in  a seiise  that  reduces  the 
airplane  tendency  to  turn  into  the  gust.  The  wind  vane 
output  signal  is  composed  of  the  tapid  change  due  to  the 
lateral  gust  plus  changes  due  to  airplane  motion  from  past 
disturbances.  An  approximate  separatioxi  of  these  signals 
is  accomplished  through  deriving  airplane  motion  from 
lateral  acceleration,  yaw  rate  and  roll  attitude  as 
shown  in  Figure  15.  The  resulting  signal  which  is 
proportional  to  the  lateral  gust  input  is  put  tnrough 
a band  pass  filter  before  being  summed  with  the  existing 
yaw  damper  signal  to  drive  the  upper  rudder.  The  purpose 
of  this  filter  is  to  remove  steady-state  sensor  errors 
and  to  prevent  excitation  of  the  flexible  body  modes. 

The  approximate  location  of  the  wind  vane  and  other  system 
components  on  the  747  airplane  is  shown  in  Figure  16. 


ANALYSIS 


For  the  purposes  of  the  analysis,  it  was  assumed 
that  the  lateral  dynamics  could  be  considered  independently 
and  that  only  lateral  gusts  were  present.  The  assumed 
form  of  these  gusts  was  the  typical  Von  Karman  spectrum. 


The  vane  output  can  be  described  as: 


S 


-u  4.  HiPb 

Vp  Vp  Vp  Vp 


CO 
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where  the  last  three  terms  give  the  sideslip  angle  at 
the  vane  location. 

To  derive  a signal  proportional  to  the  gust  input 
use  is  made  of  a lateral  accelerometer  mounted  at  the 
vane  station.  The  accelerometer  output  iss 


Ay  = Vg  + UbRb  - WbPb  + “ ^ cos6  sm<|  (2) 


consequently/ 


% I M Pb  , ^iPb 

Vo  Vp 


Vp  Vp  J 


or  approximately, 


Vp 


C4) 


It  is  therefolre  possible  to  rewrite  (l)  as; 


- VpRa)Jt  = 


GUST 


(5) 


all  the  left  side  terms  of  (5)  are  available  and  this 
equation  is  the  basis  for  mechanization  of  the  system 
as  shown  in  Figure  15. 

The  analysis  was  made  using  a Boeing  derived  computer 
program  which  accepts  matrix  inputs.  This  program  provides 
root  locus  plots  of  the  system  and  power  spectral  densities 
of  designated  param.eters  in  response  to  given  forcing 
functions.  The  complete  analysis  included  consideration 
of  the  lateral  airplane  dynamics,  roll,  autopilot,  yaw  danper 
and  gust  suppression  systaa.  The  performance  of  tlie  gust 
suppression  system  \>ras  investigated  throughout  the  flight 
envelope  of  the  airplane  with  the  intent  of  determdning 
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optimum  system  gain  for  reduction  of  the  rear  fuselage 
lateral  acGeleration  and  also  to  determine  system  stability. 
Some  particular  results  of  the  analysis  are  shown  in 
Figure  17 . Figure  17  shows  a root  locus  plot  for  different 
gains  of  the  gust  suppression  system  with  the  corres- 
ponding RMS  'g ' levels  at  an  aft  body  station  shown  in 
Figure  18,  It  can  be  seen  that  a reduction  of  about  30% 
in  the  RMS  'g ' level  can  be  obtained  at  the  bucket  of 
the  curve  shown  in  Figure  18.  This  particular  gain 
affects  the  airplane  stability  very  slightly  as  can  be 
seen  in  Figure  17 . Similar  results  were  obtained  for 
various  airplane  altitudes  and  speeds,  the  value  of  gust 
suppression  gain  remaining  essentially  the  same  for 
minimum  'g ' levels. 

The  reason  for  the  change  in  airplane  stability  is 
the  approximate  form  adopted  for  compensating  the  vane 
output  for  airplane  motion.  Theoretically,  this  signal 
could  be  perfect,  in  which  case,  the  root  locus  shown 
in  Figure  19  results  for  all  system  gains.  The  approx- 
imate method  of  compensation  was  chosen  for  practical 
impl ementation . 


TEST  RESULTS 


A system  corresponding  to  that  shown  in  Figure  15 
was  constructed  and  test  flown  in  the  747  airplane. 

Initial  flights  were  made  to  calibrate  the  wind  vane 
sensor  and  to  investigate  airplane  handling  with  the  system 
engaged  in  calm  air.  Pilot  comments  were  that  the  operation 
of  the  system  had  unde  tec  table  effect  on  handling  charac- 
teristics in  either  normal  or  emergency  maneuvers . Sub- 
sequently , several  flights  to  investigate  performance 
during  turbulence  were  made . Typical  data  from  one  such 
flight  is  shown  in  Figures  20  and  21.  Figure  20  shows  a 
typical  gust  signal  command  measured  at  the  input  to 
the  Beta  filter  summing  amplifier  while  Figure  21  shows 
the  RMS  'g ' levels  recorded  at  the  aft  body  station  with 
the  system  ON  then  OFF  in  sequence.  The  reduction  in 
acceleration  levels  with  the  system  ON  is  of  the  same 
magnitude  as  that  predicted. 
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SERVICE  EVALUATION 


To  obtain  more  data  on  the  system,  it  has  been 
installed  on  a commercial  carrier  airplane  with  a limited 
instrumentation  package.  Because  this  installation 
operates  at  a reduced  gain  while  information  is  being 
collected,  the  results  do  not  show  such  a large  reduction 
in  acceleration  levels  as  those  obtained  during  Boeing 
tests.  A typical  example  of  some  of  this  data  is  shown 
in  Figure  22,  where  a comparison  of  the  acceleration  levels 
at  an  aft  body  station  during  turbulence  is  shown  with 
the  system  ON  and  OFF. 


CONCLUSION 


The  development  and  testing  of  the  Beta-vane  and 
MSAS  systems  have  been  described.  Data  from  flight  test 
have  indicated  that  a 50-70  percent  reduction  in  aft 
body  lateral  acceleration  levels  can  be  achieved  with 
the  above  systems.  Non-linear  filtering  and  different 
sensors  will  be  the  subject  of  future  research. 
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ANALYTICAL  EQUATIONS  FLIGHT  TEST  DATA 
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ROOT  LOCUS  PLOT  OF  CONTROL  SYSTEM  BASED  ON  ANALYTICAL  EQUATIONS 

FIGURE  2 
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ROOT  LOCUS  OF  PLOT  CONTROL  SYSTEM  BASED  ON  CURVE  FIT  COMPUTER  PROGRAM 

FIGURE  3 
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BLQCIC  DIAGRAM  OF  MS  AS  CONTROL  SYSTEM 


MODAL  SUPPRESSION  AUGMENTATION  SYSTEM 


AIN  AND  PHASE  PLOT  OF  MS  AS  FILTER 
FIGURE  7 
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FUNCTIONAL  BLOCK  DIAGRAM  OF  MS  AS  MONITORING  SYSTEM 

FIGURE  10 


FIGURE  11 
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SYSTEM  EVALUATiON  IN  TURBULENCE 
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BETA  MODIFIED  YAW  DAMPER  BLOCK  DIAGRAM 

FIGURE  15 
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FIGURE  16 
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FIGURE  18 
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POWER  SPECTRUM  OF  COMPENSATED  BETA  SIGNAL  MEASURED  IN  TURBULENCE 

FIGURE  20 
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DECOUPLING  CONTROL  TECHNOLOGY  FOR  MEDIUM  STOL  TRANSPORTS 

Daniel  K.  Bird  and  Terry  L.  Neighbor 
Air  Force  Flight  Dynamics  Laboratory 

SUMMARY 

This  paper  discusses  the  advanced  control  technology  necessary  to  cope 
with  the  Medium  STOL  Transport  landing  problem  and,  in  particular,  the  neces- 
sity to  decouple  with  active  control  techniques.  It  will  be  shown  that  the 
need  to  decouple  is  independent  of  the  powered-lift  concept  but  that  the  pro- 
visioning for  decoupling  is  most  greatly  dependent  on  the  preassumed  piloting 
technique.  The  implications  of  "decoupling"  and  "active  control  techniques" 
with  respect  to  pilot  technique  options,  handling  quality  criteria,  flight 
control  mechanization,  and  the  use  of  piloted  simulation  as  a design  tool, 
will  also  be  discussed. 


INTRODUCTION 

The  Medium  STOL  Transport  (MST)  flight  control  system  must  play  a major 
role  in  combining  good  up-and-away  transport  performance  with  good  STOL  capa- 
bility. This  STOL  capability  entails  routine  operation  from  a 2000  x 60  ft. 
strip.  The  use  of  powered-lift  to  provide  the  satisfactory  low  speed  perfor- 
mance directly  adds  the  need  for  active  control  technology  while  introducing 
many  new  unknowns,  and  aggravating  the  problem  of  engine  failures.  The  basic 
foundation  for  this  paper  is  derived  from  the  results  of  recently  completed 
AFFDL  studies  to  develop  the  necessary  MST  technology.  These  studies  in- 
volved three  contractors,  Boeing,  General  Dynamics  and  North  American  under  AF 
Contracts  F33615-71-C-1757 , F33615-71-C-1754  and  F33615-71-C-1760  respectively 
and  included  a collective  total  of  approximately  500  hours  of  direct  piloted 
simulation  evaluations.  (Refs.  1,  2,  3,  4,  5) 

When  attacking  a problem  area  as  large  as  the  flight  control  system  de- 
velopment for  an  MST,  we  quite  often  lose  sight  on  the  key  points  and  tend  to 
get  bogged  down  in  minor  intracacies.  It  is  easy  to  get  Involved  in  trivial 
arguments  concerning  the  "hardware"  in  the  kitchen  before  a suitable 
"foundation"  for  the  house  has  been  established.  A stand-back-and-survey 
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view  will  therefore  be  presented  with  the  hope  that  it  will  be  enlightening. 
This  Stand-back  position  is  the  .authors'  main  advantage.  Because  of  our 
exposure  to  all  three  design  efforts  by  the  contractors,  we  saw  certain  pat- 
terns and  restrictions  occurring  that  have  more  meaning  collectively  than 
individually.  A useful  interpretation  of  these  patterns  and  restrictions 
(real  or  self-imposed)  is  the  main  contribution  we  seek  to  present. 

SYMBOLS 


AFFDL 

AFCS 

MST 

STOL 

S 

C 

n 

V 

’"z 

nz/a 


a 

3 

Y 


r 

6 


Air  Force  Flight  Dynamics  Laboratory 
Automatic  Flight  Control  System 
Medium  STOL  Transport 
Short  Take-off  and  Landing 
Rolling  moment  coefficient 

Yaw  moment  coefficient 

Velocity,  knots 
Normal  acceleration,  g's 

The  steady-state  normal  acceleration  change  per  unit  change  in 
angle  of  attack  for  an  incremental  elevator  deflection  at  con- 
stant speed » g's/ rad 
Angle  of  attack,  degs 

Sideslip  angle  at  the  center  of  gravity,  degs 

Flight  path  angle  = sin  ^ vertical  speed,  positive  for 

true  speed 

climb , degs 
Yaw  rate,  deg/Sec 
Pitch  angle,  _degs 
Airplane  heading,  degs 

MST  FLIGHT  CONTROL  PROBLEM 


Mission  Origin 

The  Medium  STOL  Transport  (MST)  flight  control  problem  has  its  origin  in 
the  mission  goals.  Briefly,  these  mission  goals  seek  a capability  of  deliver- 
ing a 28,000  pound  payload  into  a short,  narrow  (2000'  x 60')  austere  landing 
Strip,  in  addition  to  having  a cruise  Mach  number  of  0.75,  an  operation  radius 
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of  500  N.M,  and  a ferry  range  of  2600  N.M,  The  five  fundamental  phases  of 
the  flight  control  problem  are: 

1.  Take-off 

2.  Cruise 

3.  Transition  from  Cruise  to  STOL  configuration 

4.  STOL  Approach 

5.  Transition  from  STOL  Approach  to  Ground  Roll 

Of  these  phases,  the  "STOL  Approach"  receives  the  first,  and  justifiably,  the 
most  attention.  This  emphasis  is  due  to  the  relative  impact  of  this  phase  on 
the  flight  control  system,  both  in  defining  requirements  and  limitations. 
While,  in  this  paper,  we  will  concentrate  on  the  STOL  Approach,  the  problems 
which  arise  from  these  other  phases  cannot  be  ignored. 

It  is  appropriate  to  discuss  the  take-off  briefly.  There  is  a tendency 
to  refer  to  "Take-off  and  Landing"  as  a joint  lumping  of  a common  problem 
area  for  flight  control  design.  For  the  MST*s,  particularly,  the  take-off  is 
a performance  dominated  ground-to-air  problem  whose  influence  on  the  flight 
control  system  is  almost  trivial  compared  to  the  air-to-ground  landing 
problem, 

STOL  Approach  Problem 

The  performance  of  a STOL  landing  on  a 2000'  x 60'  runway  necessitates 
low  touchdown  energy  and  reduced  touchdown  dispersions.  To  achieve  these,  a 
MST  approaches  at  a low  speed  and  steep  flight  path  angle. 

This  low  speed  and  steep  approach  angle  leads  to  operation  on  the  "back- 
side" of  the  power-required  curve  and  employment  of  active  powered  lift  capa- 
bility. The  most  prominent  powered-lift  systems  under  consideration  are  shown 
in  Fig.  1.  These  powered-lift  systems  present  coupling  problems  by  their 
nature.  The  propulsive  power  that  is  now  used  directly  to  increase  lift,  also 
influences  other  force  and  moment  generation.  The  "backside"  area  of  the 
power  curve  effect  is  shown  in  Fig.  2.  Note  that  for  any  velocity  in  this 
area,  an  increase  in  thrust  setting  at  constant  attitude  results  in  an  in- 
creased flight  path  angle  with  an  accompanying  decrease  in  airspeed. 

Similarly,  if  attitude  is  increased  (with  a fixed  thrust  setting)  the  aircraft 
responds  to  decrease  velocity  and  increase  rate  of  descent.  This  adverse 
coupling  of  attitude,  airspeed  and  flight  path,  therefore,  replaces  the 
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favorable  coupling  associated  with  operation  on  the  "frontside**  of  the  power- 
required  curve.  The  problems  associated  with  a large  angle  between  the  flight 
path  vector  and  the  airplane  body  axis  extend  into  the  lateral-directional 
axes  and  further  aggravate  the  normal  coupling  in  these  axes. 

The  large  control  surfaces  required  for  low  **q**  operation  add  forces  that 
are  unfavorable  in  addition  to  the  moments  they  are  designed  to  produce.  For 
example,  a large  elevator,  in  addition  to  producing  a pitching  moment,  may 
produce  a lift  loss  of  significaht  magnitude. 

A particular  consequence  of  the  low  speed  required  is  the  increased  sen- 
sitivity to  atmospheric  disturbances,  i.e.,  wind  shears,  gusts,  and  turbu- 
lence, as  they  relate  to  both  airborne  controllability  and  landing  precision. 
Internal  disturbances  such  as  engine  failures  and  perhaps  in  combination  with 
the  **external**  disturbances  must  be  coped  with. 

Finally,  in  terms  of  conventional  **flying  quality"  parameters,  the 
dynamic  characteristics  of  the  **bare  airframe**  during  landing  approach  can  be 
generally  characterized  (Refs.  1,  2,  3,  4,  5)  as  having; 

(1)  Strongly  divergent  spiral  modes 

(2)  Low  Dutch  Roll  damping 

(3)  Long  roll  mode  time  constants 

(4)  Low  n /a  sensitivity 

Lm 

(5)  Strongly  coupled  "short  period"  and  "phugoid"  modes 

Item  5 stems  directly  from  the  attitude-speed-flight  path  coupling  men- 

tioned  earlier  and  is  worthy  of  special  comment.  The  classical  simplification 
to  separately  identify  the  *’short  period"  mode  as  an  oscillation  of  (a)  at 
constant  speed  and  the  phugoid  mode  as  an  oscillation  of  (V)  and  (y)  at  con- 
stant angle  of  attack  is  not  valid.  (Ref.  6)  **Short  term"  and  **long-term** 
response  are  as  important  as  ever  but  they  cannot  be  satisfactorily  developed 
within  the  context  of  the  classical  "short-period**  and  **phugoid’*  modes. 

FLIGHT  CONTROL  SYSTEM  DEVELOPMENT 

The  control  of  a *’powered-lift**  airplane  for  the  short  field  capability 
desired  for  MST*s  must,  therefore,  take  a far  more  basic  approach  to  the 
flight  control  system  development  than  would  normally  be  required.  The  sug- 
gested plan  of  attack  is  indicated  by  an  article  which  appeared  in  Aerospace 
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Engineering,  September  1962,  entitled,  "Control  Response  Requirements",  by 
Waldemer  0.  Breuhaus  and  William  F.  Milllken,  Jr.  The  authors  made  the  simple 
but  significant  point  that  all  flight  control  can  be  broken  down  into  three 
basic  types:  (1)  Up-Down,  (2)  Right-Left,  and  (3)  Fast— Slow.  Although  the 

article  was  written  within  the  context  of  conventional  controls,  i.e.,  eleva- 
tors, ailerons,  rudders  and  throttles,  the  present  day  correlation  with  (1) 
Direct  Lift,  (2)  Direct  Side  Force,  and  (3)  Direct  Drag,  is  obvious.  The 
presentation  that  follows  is  designed  to  show  that  the  "decoupling"  philosophy 
referred  to  in  1962  as  an  interesting  area  to  investigate  has  become  a basic 
consideration  in  the  design  of  flight  control  systems  for  the  MST's. 

A typical  landing  approach  portion  of  the  MST  landing  flight  task  is 
shown  in  Fig.  3,  This  part  of  the  landing  flight  task  will  be  emphasized 
because  it  received  the,  most  attention  in  the  completed  studies  . It  is  hard 
to  over-emphasize , .however,  that  the  transition  from  up-and-away  flight  to  the 
desired  landing  approach  speed- flight  path  profile  and  the  transition  from  the 
landing  approach  to  actual  landing  and  deceleration  to  a stop,  or  a go-around, 
must  receive  careful  attention  in  the  final  control  system  development. 
Longitudinal  Control 

"The  two  principal  quantities  that  need  to  be  controlled  in  symmetric 
flight  are  the  speed  and  the  flight  path  angle,  that  is  to  say,  the  vehicle’s 
velocity  vector.  To  achieve  this  obviously  entails  the  ability  to  apply  con- 
trol forces  both  parallel  and  perpendicular  to  the  flight  path."  (Ref.  6) 

This  enlargement  of  what  longitudinal  control  really  is , as  compared  to  the 
too  often  made  assumption  that  longitudinal  control  is  limited  to  "elevator 
control",  is  one  of  the  important  messages  of  flight  control  development  for 
the  MST's.  The  second  is  the  supposition  that  the  pilot  and/or  autopilot  must 
be  able  to  make  commands  for  speed  changes  without  materially  affecting  flight 
path  and  conversely  the  ability  to  make  flight  path  angle  changes  without 
materially  affecting  speed.  Fig.  4 illustrates  the  design  approach  indicated 
for  the  longitudinal  control  provisions.  There  is  no  commitment  at  this  point 
as  to  what  input  device  will  be  used  to  command  speed  change  or  flight  path 
change  or  what  force  or  moment  generators  will  be  used  for  control.  There  is 
no  direct  control  of  (6)  or  consequently  (a).  The  assumption  is  made  that  the 
airplane  is  "trimmed"  for  a given  speed-flight  path  profile  and  that  detection 
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of  changes  in  this  profile,  (V)  speed  and  (y)  f light-path,  can  be  detected 
and  acted  upon  by  the  pilot  and/or  autopilot.  Fig.  4 serves  as  a common 
starting  point  to  discuss  the  development  of  two  MST  longitudinal  flight  con- 
trol systems  by  two  separate  contractors.  One  of  the  contractors  featured  an 
Externally  Blown  Flap  (EBF)  version  for  his  study  model  and  the  other  used  a 
Mechanical  Flaps  plus  Vectored  Thrust  version. 

EBF  Version 

The  key  to  the  manner  in  which  this  would  develop  was  this  early  state- 
ment , "In  addition  to  the  elevator,  throttle  and  flaps  are  available  for 
flight  path  control.  The  literature  and  experience  indicates  that  the  pilot 
would  like  to  control  flight  path  with  the  throttle  on  a power  approach,  where 
significant  lift  is  due  to  the  throttle.  However,  the  coupling  of  airspeed 
and  flight  path  through  each  of  these  controls  makes  bare  airframe  control 
deficient . " ^ , 

In  effect,  this  philosophy  indicates  a strong  preference  to  change  the 
general  form  of  Fig.  4 to  assign  a throttle  level  as  the  flight  path  command 
device.  The  same  contractor  goes  on  to  say,  "A  direct  lift  system  via 
throttle  control  gives  the  pilot  two  distinct  means  of  controlling  flight 
path : 

1.  Heave  control  with  the  throttle,  with  minor  pitch  changes. 

2.  Pitch  control  with  the  elevator,  which  depends  on  an 
adequate  (n^/a)  to  minimize  (a)  changes  and  make  pitch 
changes  result  in  flight  path  changes. 

The  equation  (y  = 0-a)  expresses  the  two  techniques,  the  heave  control 
corresponding  to  changing  (y)  with  (a)  and  pitch  control  changing  (y)  with 
(0)v*  The  linear  derivatives  indicate  the  throttle  to  be  a better  direct 


*This  statement  is  particularly  interesting  and  significant  for  powered  lift 
MST’s.  The  general  definition  of  (ot)  = tan”^w/u  does  not  exclude  this  concept 
of  (y)  change  with  (a).  It  is  a change  in  the  conventional  sense  of  (a), 
however,  that  must  be  carefully  recognized  in  the  application  of  many  existing 
parameters,  nz/a  for  example,  is  defined  in  MIL-F-83300  as  "the  steady  state 
normal  acceleration  change  per  unit  change  in  angle  of  attack  for  an  incre- 
mental pitch  control  deflection  at  constant  speed",  and  in  MIL-F-8785  as  "the 
steady-state  normal  acceleration  change  per  unit  change  in  angle  of  attack  for 
an  incremental  elevator  deflection  at  constant  speed  (airspeed  and  Mach 
number)". 
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lift  control  and  the  flaps  as  better  speed  control  as  seen  by: 


^thrust 

thrust 


where 


-0.1316 
+0. 0351 


^ flaps  _ 23.48 


flaps 


14.89 


1.575” 


Z 

thrust 
X ^ 

thrust 


and 


Ratio  of  change  in  vertical  force  (Z-axis)  per  change  in 
horizontal  force  (X-axis)  for  a given  change  in  engine 
thrust. 


Z 

flaps  _ Ratio  of  change  in  vertical  force  (Z-axls)  per  change  in 

X 

flaps  horizontal  force  (X-axis)  for  a given  change  in  flaps 

deflections . 

As  a result  of  this  reasoning,  the  contractor  used  decoupling  cross  feeds 
to  the  trailing  edge  flaps  to  minimize  speed  changes  due  to  flight  path 
commands  through  the  throttle  levers.  He  then  constrained  the  control  column 
to  command  elevator  deflections  only.  Further  refinements  included  an  auto- 
speed mode  which  controlled  to  the  selected  speed  directly  by  using  the 
trailing  edge  flaps  as  the  primary  speed  correcting  output.  An  attitude-hold 
mode  was  also  used  to  minimize  attitude  coupling  from  flight  path  commands 
through  the  throttle  lever. 

The  functional  operation  of  this  type  of  system  is  generally  illustrated 
in  Fig.  5.  In  essence,  they  provided  "direct  lift  control"  as  direct  control 
of  engine  thrust  magnitude  and  as  commanded  through  the  throttle  levers  as 


Both  of  these  definitions  constrain  the  generality  of  (a)  for  the  purpose 
of  applying  the  specification  criterion  n^/a.  Further,  the  equation  (y  = 

0-a)  is,  in  itself,  a severe  constraint  on  the  vantage  point  that  must  be 
attained  to  fully  cope  with  the  MST  landing  problem.  (y)  is  defined  in  MIL- 
F-8785  as  sin“^  vertical  speed/true  airspeed.  The  distinction  between  this 
(y),  defined  with  respect  to  the  "air  mass",  and  a (y)  defined  with  respect 
to  the  ground  tan*^^  vertical  speed/ground  speed  is  too  significant  to  ignore 
for  the  landing  speeds  and  touchdown  precision  required  for  the  MST’s. 

Related  criteria  such  as  9y/9V  must  also  be  carefully  reviewed  for  application 
on  MST’s.  The  use  of  this  criteria  within  the  context  of  MIL-F-83300  and 
MIL-F-8785  is  not  only  purposely  limited  to  the  "air  mass"  reference  but  also 
requires  that  it  must  be  measured  with  constant  thrust  in  both  direction  and 
magnitude  and  with  a perturbation  of  the  airplane  solely  by  an  "elevator"  or 
equivalent  (9)  change  producing  device. 
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their  main  flight  path  control  provision.  They  went  on  to  conclude: 

”In  regard  to  piloting  techniques  for  STOL  terminal  area  flight 
operations,  there  is  clearly  a preference  for  the  STOL  mode  of 
flight  path  control,  i.e.  , power  level  adjustments  for  flight 
path  error  corrections  with  relatively  constant  pitch  attitude 
maintained  by  a pitch-attitude-hold  mode  and  airspeed  regulated 
by  the  autospeed  function," 

Mechanical  Flaps  Plus  Vectored  Thrust  Version 

The  key  to  this  contractor’s  philosophy  with  respect  to  Fig.  4 is 
indicated  by  this  statement: 

"Pilots  confirmed  that  they  could  use  ’conventional’  techniques  for 
controlling  flight-path  angle  and  airspeed.  The  ’conventional’ 
technique  implies  that  flight  path  angle  is  controlled  with  the 
column  and  that  thrust  vector  angle  is  used  for  controlling  air- 
speed. The  other  control  technique  often  used  for  STOL  approaches 
involves  controlling  airspeed  with  the  control  column  and  flight 
path  angle  with  thrust  magnitude." 

A control  law  structure  that  evolved  from  this  concept  is  shown  in  Fig. 

6.  The  use  of  this  control  during  approach  assumes  that  thrust  vector  trail- 
ing edge  flaps,  thrust  level  and  spoiler  deflection  have  all  been  set  to 
satisfy  "trim"  for  the  desired  flight  path-speed  profile.  Flight  path  angle 
deviations  are  controlled  through  the  control  column  which  commands  elevator 
and  spoiler  deflections  about  "trim"  and  speed  deviations  are  controlled  by 
closing  an  automatic  speedloop  which  varied  the  thrust  vector  angle  around  the 
trim  point,  approximately  70°  with  the  horizontal.  A closed-loop  decoupling 
crossfeed  was  found  to  be  necessary  for  flight  path  angle-to-speed  changes. 

The  use  of  thrust  vector  angle  changes  to  control  speed  reduced  the  speed-to- 
flight  path  (open  loop)  coupling  to  a point  where  cancelling  by  closed-loop 
decoupling  was  not  considered  necessary. 

Summary  of  the  Two  Contractor  Approaches 

Each  contractor  recognizes  the  flight  path  angle-speed  coupling  problem. 
Each  contractor  made  an,  a priori,  assumption  as  to  what  input  device  would  be 
used  to  correct  flight  path  deviations;  in  one  case  a throttle  lever,  and  in 
the  other,  a control  column  and  then  suppressed  the  pilot  effort  associated 
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with  speed  corrections  by  using  an  automatic  speed  control  loop.  In  the  first 
case,  the  closure  of  the  automatic  speed  loop  was  accomplished  by  deflecting 
the  flaps  about  the  trim  position  and  thus  vectoring  the  thrust  indirectly 
with  the  flaps.  In  the  second  case,  the  efflux  of  the  engine  was  vectored 
directly.  Each  arrived  at  a method  of  exerting  forces  for  speed  control,  X- 
axis  forces,  that  minimized  the  coupling  of  Z-axis  (lift)  forces. 

Each  used  direct-lift  to  minimize  speed  changes  caused  by  flight  path 
change  commands.  In  one  case  the  "direct-lift”  was  in  the  form  of  thrust  mag- 
nitude modulation  about  the  trim  position  and  in  the  other  case  symmetrical 
spoiler  deflection  about  a trim  position.  Each  was  able  to  demonstrate  within 
a reasonable  degree  of  validation  that  the  control  of  their  respective  study 
models,  EBF  and  Mechanical  Flaps  Plus  Vectored  Thrust  was  generally  satis- 
factory for  an  MST  landing  approach.  Each  contractor  described  his  results  as 
vindication  of  (1)  the  "STOL  technique  in  one  case  and  (2)  the  "Conventional" 
technique  in  the  other.  Substantiation  arguments  included  the  observation 
that  when  the  "Conventional"  technique  was  used  with  the  "STOL"  technique 
system  designed  for  the  EBF  version,  its  performance  was  poorly  rated  by  the 
simulation  pilots.  On  the  other  side  of  the  coin,  it  was  pointed  out  that  the 
"Conventional"  technique  was  preferred  for  the  Ffechanical  Flaps  Plus  Vectored 
Thrust  version  because: 

"(1)  With  the  thrust  vector  set  at  approximately  70*’ , changes  in  vector 
angle  primarily  produce  axial  acceleration,  with  a small  change  in 
normal  acceleration. 

(2)  In  the  nominal  approach  condition  and  with  the  power  set  at  75%  of 
maximum,  the  aerodynamics  and  propulsive  normal  acceleration 
capability  la  (with  DLC)  - .45g  and  A„^ 

With  a single  engine  failure,  thrust  * ^ thrust  to 

weight  ratio  is  maintained." 

The  comments  quoted  in  support  of  either  the  "Conventional"  technique  or 
the  "STOL"  technique  are  true  statements.  Their  relevance  to  supporting 
either  "technique"  and  to  IKT  longittKlinal  control  provisioning  in  general, 
however,  needs  examination. 

"STOL"  versus  "Conventional"  Technique? 

Many  papers  have  been  written  that  discuss  this  choice.  The  overwhelming 
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majority  of  these  papers  make  the  often  non-stated  assumption  that  a control 
column  or  stick  command  is  synonomous  with  elevator  deflection  and  the 
throttle  lever  is  synonomous  with  engine  thrust  modulation.  Under  this  con- 
straint, there  isn’t  much  left  to  close  the  coupled  flight  path  angle-speed 
control  loops,  other  than  "pilot-technique".  Augmentation  and  automation 
techniques  that  are  restricted  to  operating  through  only  the  elevators  or 
engine  thrust  commands  will  also  be  of  dubious  help  because  of  the  inherent 
coupling.  For  airplanes  already  built,  the  pilot-technique  issue  has  validity 
because  it  is  a case  of  doing  the  best  you  can  with  the  only  variable  left  to 
analyze,  the  pilot  himself.  For  the  "powered  lift"  MST’s  however,  the  so- 
called  "STOL"  versus  "Conventional"  landing  technique  issue,  as  it  is  normally 
presented,  is  of  extremely  doubtful  validity. 

The  argument  that  the  system  designed  for  the  "STOL"  technique  would  not 
perform  well  when  the  "Conventional"  technique  was  applied  or  vice  versa,  is 
not  really  a supporting  argument.  The  pilot  is  no  longer  commanding  an 
"elevator"  or  "throttle"  or  selecting  a technique  to  use  them;  he,  or  the 
AFCS,  is  coramandlng  flight  path  corrections  or  speed  corrections  through  what- 
ever input  device  was  assigned.  Any  attempt  to  interchange  the  use  of  these 
assigned  devices , which  now  command  a set  of  force  and  moment  generators 
through  a control  law  structure  deemed  most  suitable  to  make  flight  path  or 
speed  corrections  separately,  is  obviously  going  to  be  difficult.  The  after- 
the-fact  pilot  option  has  been  removed,  the  real  issue  is  the  basis  on  which 
the  cockpit  control  assignment  is  made  to  best  serve  the  MST  mission. 

Other  Control  Considerations 

Fig.  4,  as  stated  previously,  makes  the  assumption  that  the  airplane  is 
in  "trim"  during  landing  approach.  As  a part  of  these  same  studies,  at  least 
one  contractor  found  that  the  transition  from  up-and-away  flight  to  the  con- 
figuration required  for  landing  approach,  plus  capture  and  "trim"  to  the 
required  flight  path-speed  profile  is  difficult.  It  should  be  obvious  that 
the  assignment  of  cockpit  controls  cannot  be  made  without  careful  considera- 
tion of  how  they  can  best  serve  these  transition  needs.  Fig.  4 makes  it  clear 
that  "attitude"  during  the  landing  approach  is  not  necessarily  the  dominating 
control  parameter.  It  is  only  important  to  restrain  "attitude"  changes  within 
certain  limits.  When  the  transition  is  made  from  landing  approach  (airborne 
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flight)  to  touchdown  (ground  control)  however,  attitude  must  be  reconciled 
along  with  a probable  change  in  flight  path  from  the  "trimmed"  condition. 

The  effects  of  engine  failures  and/or  the  need  for  a go-around  must  also 
be  considered.  The  pilot  must  be  given  a control  system  that  minimizes  his 
workload  in  dealing  with  these  emergencies.  Finally,  harmony  with  up-and- 
away  flight  where  95%  of  the  mission  time  will  be  spent  must  be  considered. 

It  is  in  this  up-and-away  flight  regime  where  a more  fundaroental  sense  of 
what  "Conventional"  flight  control  really  consists  of  can  be  more  clearly 
illustrated.  A recent  paper  (Ref.  7)  states, 

"The  pilot  must  control  the  aircraft  velocity  vector  in  a three 
dimensional  space.  In  a conventional  airplane,  the  two  vector 
angles  (y,!!^)  usually  are  tracked  using  column  and  wheel  Inputs,  and  the 
vector  magnitude  (V)  is  controlled  in  essentially  open  loop  or 
discontinuous  fashion  using  throttle  inputs". 

The  relegation  of  vector  magnitude  (Fast-Slow)  control  to  an  "essentially 
open-loop  or  discontinuous"  manner  is  a key  element  of  conventional  flight 
control.  For  the  MST's  this  type  of  control  is  no  longer  satisfactory  during 
landing  approach  because  of  the  severe  coupling  problem.  Further,  the  control 
of  speed,  vector  magnitude  (V),  cannot  necessarily  be  limited  to  thrust  magni- 
tude modulation,  and  finally,  the  manual  closure  of  this  control  loop  by  the 
pilot,  in  addition  to  closing  his  (y>i)^)  (Up-Down)  (Right-Left)  loops  does  not 
appear  desirable  from  a pilot  workload  basis.  The  weight  of  the  evidence 
indicates  that  (V)  must  be  controlled  independent  of  the  pilot,  i.e. , auto- 
matically. Still  another  factor  is  worth  emphasizing  in  the  selection  of  the 
longitudinal  control  provisioning  for  the  MST’s. 

The  landing  of  an  MST  and  subsequent  deceleration  to  a stop,  or  a go- 
around  are  obviously  "energy- control"  problems.  (Ref.  8)  The  rate  of  energy 
consumed  (fuel)  as  it  affects  the  total  airplane  energy  state,  potential 
(height)  plus  kinetic  (speed),  is  directly  changed  by  the  engine  thrust  lever. 
On  the  other  hand,  control  forces  used  to  change  flight  path  generally  only 
transfer  potential  energy  (height)  to  kinetic  (speed)  or  visa  versa.  ' 

This  energy  concept  does  not  lead  to  some  easily  perceived  longitudinal 
control  provisioning  concept  for  the  MST’s.  It  is  fundamentally  significant, 
however,  and  far  more  relevant  than  trying  to  justify  the  system  on  a 
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preconceived  "STOL"  or  "Conventional”  technique  basis.  The  merits  of  the 
longitudinal  control  provisioning  must  stand  on  its  own  feet. 
Lateral-Directional  Control 

A vantage  point  for  the  lateral-directional  control  problems  is  illus- 
strated  by  this  quotation: 

"This  simplicity  is  lost  (the  author  is  referring  to 
longitudinal  control)  when  we  go  to  lateral  motions , 
for  then  the  rotation  takes  place  about  two  axes  (x) 
and  (z) . The  moments  associated  with  these  rotations 
are  cross  coupled,  l.e. , (p)  produces  yawing  moments 
Cjj)  as  well  as  rolling  moment  C^  , and  yaw  displacements 
(g)  and  rate  (r)  both  produce  rolling  and  yawing 
moments.  Furthermore,  the  roll  and  yaw  controls  are 
also  often  cross-coupled,  deflection  of  the  ailerons 
can  produce  significant  yawing  moments,  and  deflection 
of  the  rudder  can  produce  significant  rolling  moments." 

(Ref.  6) 

In  view  of  the  previous  discussion  under  longitudinal  control,  the  reader 
is  certainly  entitled  to  question  the  "simplicity-comparison",  the  com- 
parison is  thought  significant  however.  The  need  to  provide  "decoupling"  in 
some  degree  has  long  been  recognized  for  Right-Left  control,  while  the  need 
to  do  so  for  good  (Up-Down)  (Fast-Slow)  is  only  fully  appreciated  when  control 
must  be  provided  near  the  minimum  speed  possible  with  "powered  lift" 
techniques. 

The  treatment  of  lateral-directional  control  and  its  relationship  to 
"decoupling"  will  therefore  be  less  emphasized  in  this  paper  than  longitudinal 
control,  although  this  is  not  intended  to  suppress  its  importance.  Landing 
on  a 60  ft  wide  strip  in  the  presence  of  "disturbances"  is  a demanding  flight 
task. 

None  of  the  contractors  involved  in  the  studies  investigated  using  direct 
side  force  for  better  Right-Left  control  although  it  has  attractive  possi- 
bilities. The  decoupling  approach,  therefore,  was  immediately  reduced  from 
the  generality  presented  in  the  longitudinal  to  that  shown  in  Fig.  7,  i.e., 
the  control  surfaces  are  conventional  moment  generators.  The  control  law 
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development  itaplied  by  Fig.  7 stems  directly  from  the  Etkins  quote  and  the 
"decoupling"  concept  that  the  control  wheel  will  command  (p)  without  inducing 
(6)  and  the  rudder  pedals  will  command  (8)  without  inducing  (p) . 

Fig.  8 illustrates  typical  control  laws  that  can  develop  from  this  pre- 
mise. There  can  be  no  doubt  that  many  of  the  symptoms  of ‘poor  Right-Left 
control  are  removed  by  these  active  techniques*  The  Initial  development  of 
undesired  (8)  during  entry  into  the  turn  can  be  largely  cancelled  out  by  feed- 
forward into  the  rudder,  and  the  remainder  well  suppressed  by  feedback  tech- 
niques. "Feedforward  is  really  a very  old  trick  to  cancel  out  the  effects  of 
disturbances  before  they  have  altered  the  output"  (Ref.  9),  In  this  case,  the 
"disturbance"  is  an  unwanted  coupling  of  the  outputs. 

The  Dutch  Roll  modes  can  be  damped  reasonably  well  and  perhaps  at  least 
as  important,  the  tendency  to  "stlr-them-up"  with  roll  rate  commands  can  be 
largely  removed.  The  spiral  mode  can  be  made  essentially  neutral  such  that 
the  bank  angle  tends  to  neither  increase  nor  bleed  off  during  the  turn.  The 
effective  roll  time  constant  can  be  decreased  such  that  the  small  precise 
heading  changes  associated  with  landing  on  a minimal  width  runway  can  be 
enhanced. 

The  decoupling  techniques  used  for  lateral-directional  control  are  not  as 
sensitive  to  the  remainder  of  the  total  flight  regime  as  the  longitudinal  pro- 
visioning. The  transition  from  landing  approach  to  ground^roll,  however,  has 
a similar  problem  in  that  "attitude"  must  be  reconciled  and  particularly  so 
when  landing  in  a cross  wind.  If  the  crab  angle  is  accepted  during  the 
landing  approach  (zero  8) > then  decoupling  is  desired  to  change  the  heading 
"attitude"  of  the  airplane  to  that  of  the  runway  just  prior  to  touchdown  with- 
out changing  flight  path.  The  removal  of  yaw-to-roll  coupling  goes  a long  way 
towards  achieving  this  type  of  flight  path-to-attltude  decoupling.  If  the 
forward-slip  maneuver  is  executed,  then  the  purposeful  coupling  must  be 
"unwound"  and  the  roll  attitude  of  the  airplane  reconciled  with  the  ground, 
again  without  materially  affecting  flight  path. 

There  is  one  more  aspect  of  "decoupling"  that  deserves  mention,  the  cou- 
pling of  lateral-directional  or  Right-Left  control  into  (up-Down)  (Fast-Slow) 
control.  If  heading  changes  are  to  be  made  without  change  of  flight  path 
or  speed  in  the  XZ-plane,  then  compensation  must  be  provided  for  the  loss  of 
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lift  due  to  bank  angle.  A relatively  simple  cross feed  of  lift  compensation 
per  unit  bank  angle  can  be  established  if  the  previous  "decoupling"  of  flight- 
path  and  speed  has  been  accomplished. 

IMPLICATIONS  FOR  DESIGN 

The  emphasis  on  decoupling  just  presented,  is  not  an  argument  that  com- 
plete "decoupling’*  must  be  provided  for  landing  powered  lift  MST^s.  For  many 
sound  and  substantial  reasons,  this  is  not  likely  to  be  either  completely 
possible  or  desirable.  This  presentation  is  an  argument,  however,  that  the 
principles  involved  in  decoupling  must  be  thoroughly  understood  before  the 
trades  involved  in  backing-off  can  be  justified.  One  of  the  most  significant 
trades  will  be  discussed  briefly. 

Flight  Path-Speed-Attitude 

The  maturity  of  attitude  sensors  is  well  established  whereas  the  ability 
to  sense  absolute  flight  path  angle  with  respect  to  the  ground  involves  find- 
ing the  arctan  vertical  speed/groimd  speed.  The  latter  quantity  can  be  sub- 
stantially different  from  airspeed  and  is  not  easy  to  obtain.  A good  attitude- 
hold  loop,  in  itself,  does  a great  deal  to  minimize  the  coupling  between 
flight  path  and  speed.  On  the  other  hand,  the  importance  of  controlling  to  an 
absolute  ground  referenced  flight  path  for  MST^s  can  be  appreciated  by  reading 
the  article,  "Effects  of  Wind  Shear  on  Approach’*,  by  Captain  W.  W.  Melvis, 

Delta  Airlines,  in  the  June,  1971  issue  of  Interceptor  Magazine.  The  article 
discusses  the  problems  of  flight  path  and  speed  control  in  the  context  of  120 
kt  landing  approach  speeds.  The  increased  concern  at  the  MST  landing  approach 
speeds  should  be  obvious. 

Handling  Qualities  Criteria 

There  are  many  things  that  cotild  be  said  about  this  controversial  aspect 
of  the  MST’s  and  as  it  relates  to  MIL-F-83300  and  MIL-F-8785.  A few  of  the 
observations  considered  most  significant  are  listed  here: 

1.  The  concept  of  pilot  workload  as  it  relates  to  the  MST 
landing  task  performance  and  as  set  forth  in  MIL-F-83300  and  MIL-F-8785  is  a 
soxmd  and  valid  measure  of  "goodness”  for  MST  "flying-qualities"  or  perhaps 
more  aptly  titled  Flight  Control  Performance. 

2.  The  interpretation  of  the  pilot  workload  concept  into 
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mutually  verifiable,  necessary  and  sufficient,  contractor-customer  "flying- 
quality"  requirements  is  not  presently  satisfied  by  either  MIL-F-8785  or  MIL- 
F-83300.  In  general,  MIL-F-8785  purposely  excludes  applicability  to  powered- 
lift  , direct-lift , direct-drag  and  those  active  techniques  directly  associated 
with  satisfactory  MST  landing  capability,  while  MIL-F-83300  is  too  strongly 
oriented  towards  STOL  as  a transition  to  or  from  VTOL  instead  of  an  extra- 
polation from  CTOL. 

3.  The  main  effect  of  this  vacuum  of  applicability  is  to  put  a 
far  higher  premium  on  the  use  of  piloted  simulation  as  a "tool"  for  both 
contractor  design  development  and  customer  assessment. 

Piloted  Simulation 

It  is  difficult  to  make  judgment  as  to  which  aspect  of  MST  landing  simu- 
lation was  violated  the  most,  the  fidelity  of  the  simulation  required  to  be 
representative  of  what  the  pilot  will  actually  experience,  or  the  manner  in 
which  the  simulation  experiments  wefe  conducted.  The  representation  of  all 
forces  acting  on  the  airplane  for  the  powered-lift  MST's  is,  at  least,  an 
order  of  magnitude  more  complex  than  for  a conventional  airplane.  Further, 
the  quality  of  the  vehicle  dynamics  data  is  susceptible  to  poor  predictive 
techniques  and  the  system  design  evaluations  must  recognize  the  need  to  con- 
sider variations  from  those  assumed,  even  with  extensive  wind  tunnel  data. 

The  quality  of  the  visual  (outside  world)  presentation  to  the  pilot  has 
been  troublesome.  Unless  the  pilot  is  convinced  that  the  representation  is 
realistic,  particularly  in  the  landing  touchdown  transition  area,  the  validity 
of  the  simulation  data  for  design  purposes  is  tenuous. 

Motion  can  be  required,  particularly  for  investigation  of  engine  failures, 
however,  it  is  easy  to  overrate  as  a critical  simulation  parameter.  Follow  up 
experiments  from  fixed  base  to  moving  base  during  the  MST  studies  revealed 
lateral  acceleration  as  perhaps  the  most  significant  external  force  cue. 

A large  problem  in  accepting  the  piloting  simulation  data  from  these  MST 
studies  was  the  promiscuous  use  of  Cooper  Rating.  The  use  of  Cooper  Rating  as 
an  after-the-fact  evaluation  is  one  thing.  The  use  of  Cooper  Rating  for 
design  feedback  without  an  active  questioning  of  how  and  why  the  evaluations 
were  given  denies  the  needed  use  of  piloted  simulation  as  a design  tool. 
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Flight  Control  System  Mechanization 

The  "hardware"  implementation  is  necessarily  discussed  last  because  this 
choice  must  first  of  all  be  based  on  ability  to  satisfy  the  control-laws  found 
necessary  and  as  they  encompass  "decoupling"  with  active  techniques.  It  is 
short-sighted  to  be  in  a hurry  to  discuss  safety,  reliability,  and  maintain- 
ability until  the  mechanized  capability  to  perform  the  job  can  be  established. 
The  mechanizing  job  shares  a common  facet  with  other  parts  of  MST  development, 

l.e.,  the  need  to  avoid  premature  commitments  based  on  past  mechanizing 
practices.  A short  saga  of  the  MST  mechanizing  problem  unfolds  in  the 
following  manner. 

Pure  mechanical  systems  cannot  provide  sufficient  performance.  Pure  Fly- 
by-Wire systems  have  Sufficient  performance  but  invite  risks  at  this  time 
that  do  not  seem  justifiable  when  compared  to  the  performance  attainable  with 
a hybrid  mechanical-electrical  system.  Tha  number  one  issue,  therefore,  is 
how  to  design  this  hybrid  mechanical-electrical  system  in  a fashion  that  makes 
the  best  possible  Integrated  use  of  these  two  types  of  signal  transmission 
and  which  recognizes  in  particular  the  overriding  electromechanical  Interface 
problem. 

GONGLUSIONS 

1.  The  need  for  "decoupling"  by  active  control  techniques,  i.e.  , separate 
non-interacting  Up-Down,  Right -Left,  Fast-Slow  control,  is  an  essential  part 
of  MST  flight  control  system  design. 

2.  Gockpit  controllers  must  be  distinguished  from  the  force  and  moment 
generators  they  control. 

3.  Piloted  simulation  must  be  used  more  extensively  as  a design  tool. 

4.  Although  the  "landing  approach"  area  is  significant,  the  MST  flight  con- 
trol system  must  fxilly  recognize  the  total  mission. 
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POTENTIAL  BENEFITS  OF  PROPULSION  AND  FLIGHT  CONTROL 

INTEGRATION  FOR  SUPERSONIC  CRUISE  VEHICLES* 

Donald  T.  Berry  and  William  G , Schweikhard 
NASA  Flight  Research  Center 


SUMMARY 


Supersonic  cruise  aircraft  can  exhibit  strong  interactions  between  the  propulsion 
system  and  the  airfi*ame . These  interactions  can  be  aggravated  or  improved  by  the 
behavior  of  the  propulsion  control  system  and  the  flight  control  system . When  these 
controls  are  designed  independently , they  tend  to  affect  the  interactions  adversely . 
When  the  propulsion  and  flight  controls  are  integrated , however , the  benefits  can  be 
synergistic . 

This  paper  reviews  typical  airframe/propulsion  interactions  such  as  Mach/ 
altitude  excursions  and  inlet  unstarts . The  improvements  in  airplane  performance 
and  flight  control  that  can  be  achieved  by  improving  the  interfaces  between  propul- 
sion and  flight  control  are  estimated . A research  program  at  the  NASA  Flight 
Research  Center  to  determine  the  feasibility  of  integrating  propulsion  and  flight  con- 
trol is  described.  This  program  includes  analytical  studies  and  YF-12  flight  tests. 


INTRODUCTION 


Interactions  between  airframes  and  propulsion  systems  go  back  to  the  earliest 
history  of  powered  aircraft . Along  with  the  stories  of  daring  aviators  in  open  cock- 
pits , we  also  heard  of  large  rolling  moments  due  to  rotary  engine  torque  and  yawing 
moments  induced  by  propeller  slipstream . Interactions  such  as  these  were  handled 
in  a straightforward  manner  by  applying  large  amounts  of  lateral  stick  and  rudder 
control.  The  introduction  of  jet  engines  at  first  alleviated  these  interactions . How- 
ever, as  flight  speeds  increased,  propulsion  systems  became  more  eomplex  and 
sophisticated.  A typical  supersonic  cruise  aircraft  has  an  inlet  with  variable  geom- 
etry features  programed  by  engine,  inlet,  and  airframe  variables.  These  propulsion 
system  features  influence  the  thrust , drag , performance , stability , and  control  of 
the  entire  vehicle  . Efficient  utilization  of  these  interactive  effects  could  greatly 
enhance  the  overall  effectiveness  of  a supersonic  cruise  vehicle . To  accomplish  this , 
the  engine , inlet , and  flight  controls  must  be  integrated  so  that  they  work  coopera- 
tively for  optimum  vehicle  performance . 


*Based  on  SAE  paper  740478,  1974. 


PACS  BLANK'  NOt 


433 


This  paper  describes  the  principal  types  of  interaction  phenomena  that  have 
been  encountered  in  NASA  flight  research  (refs . 1 and  2)  and  proposes  approaches 
and  solutions  to  interaction  problems.  It  discusses  the  potential  benefits  of  inte- 
grating propulsion  and  flight  controls  into  a cooperative  airframe/propulsion  control 
system  and  describes  a research  program  to  determine  the  feasibility  of  the  system 
and  to  demonstrate  it  in  an  operational  environment  . 


SYMBOLS 


BPD 

g 

^X’^Z 
L = 57 .3 


bypass  door  opening , percent  of  full  open 
acceleration  due  to  gravity , m/sec* 

moment  of  inertia  about  the  X-  and  Z-body  axes,  respectively,  kg-m* 
Rolling:  moment^  deg/sec* 

lx 


= 57.3  Rolling  nioment  due  to  uns^t  ^ ^eg/sec^ 

uirist3.i*t 


N = , deg/sec^ 

Z 


N 

6 

6 


unstart 

a 

r 


2 Yawing  moment  due  to  unstart 

iz 


aileron  deflection , percent  of  maximum  deflection 


rudder  deflection , percent  of  maximum  deflection 


^ Dutch  roll  damping 

co^  Dutch  roll  damped  natural  frequency,  rad/ sec 

co^  Dutch  roll  natural  frequency,  rad/ sec 

Subscripts: 

BPD , 6 ,6  partial  derivatives  with  respect  to  subscripted  variable 

Q.  2* 


max  maximum 
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DESCRIPTION  OF  INTERACTIONS 


The  types  of  interactions  to  be  discussed  are  shown  in  figure  1,  in  which  the 
flight  vehicle  is  considered  to  consist  of  three  elements:  airframe,  engine,  and 
inlet.  Many  interactions  are  possible  between  these  elements,  and  all  possible  com- 
binations have  probably  occurred , at  least  to  a minor  extent . The  figure  illustrates 
three  typical  types  of  interactions  that  have  been  observed  during  NASA  flight  re- 
search: (1)  the  F-104  airplane  interactions  primarily  involve  the  airframe  and  the 

inlet;  (2)  the  F-111  airplane  interactions  are  primarily  between  the  engine  and  the 
inlet;  and  (3)  the  XB-70  and  YF-12  airplane  interactions,  which  are  typical  of 
supersonic  cruise  aircraft  with  mixed-compression  inlets,  primarily  involve  the 
airframe,  inlet,  and  engine. 

A prime  example  of  an  airframe/inlet  interaction , shown  in  figure  2,  was 
observed  during  the  development  of  an  F-104  airplane.  Uncontrolled  airplane  motion 
began  when  the  pilot  initiated  a left  roll  at  Mach  1.87  (time  = 0.8  sec) , which  caused 
the  airplane  to  sideslip.  This  precipitated  an  engine  surge  at  time  = 2.5  seconds, 
which  resulted  in  an  engine  mass  flow  reduction . A detailed  analysis  (ref . 3) 
showed  that  this  reduction  in  mass  flow  forced  the  inlet  shock  forward  on  the  lee  side 
of  the  fuselage , creating  a higher  yawing  moment  in’the  opposite  direction.  The 
phase  relationship  to  the  natural  frequency  of  the  airplane  was  such  that  the  vehicle's 
oscillations  were  divergent  . After  one-half  cycle  of  the  oscillation  , the  throttle  was 
retarded  to  prevent  an  engine  overtemperature  which  could  have  resulted  from  the 
surge . This  power  change  further  aggravated  the  yawing  motion  by  reducing  the 
mass  flow  through  the  inlet  and  causing  the  sideslip  to  exceed  the  2°  limit  of  the  air- 
plane . 

The  angle-of-attack  excursions  shown  in  figure  2 represent  a pitching  oscilla- 
tion of  1.5g  to  2.0g  . The  left  and  right  side  inlet  recovery  indicates  the  magnitude 
of  the  inlets'  active  participation  in  the  motion.  The  interaction  was  eliminated  on 
subsequent  flights  by  extending  the  splitter  plate  between  the  left  and  right  side 
inlets  back  to  the  compressor  face,  as  shown  in  the  sketch.  This  reduced  the  cross- 
flow  between  the  two  inlets  that  had  caused  the  shock  motions . 

The  F-111  airplane  is  an  example  of  an  interaction  primarily  between  the  engine 
and  the  inlet  (ref  . 4)  . A time  history  of  a dynamic  interaction  on  the  F-lllA  air- 
plane is  shown  in  figure  3 . These  data  were  obtained  during  stabilized  flight  and 
constant  power  setting  at  a Mach  number  of  2.17.  The  dynamic  distortion  of  the 
inlet  initially  oscillated  within  the  stall  limits  but  finally  peaked  above  the  boundary , 
resulting  in  an  engine  stall  and  an  aborted  flight . No  significant  airframe  inter- 
actions induced  by  the  engine  or  the  inlet  were  noted  during  the  NASA  flight  tests 
of  the  F-111  airplane  in  which  more  than  100  engine  stalls  were  experienced  through- 
out the  flight  envelope  . 

For  maximum  efficiency , supersonic  cruise  vehicles  usually  have  a mixed- 
compression  inlet,  that  is , an  inlet  in  which  the  normal  shock  is  in  the  throat  rather 
than  outside  the  cowl  lip , This  provides  the  highest  inlet  recovery  and  the  best 
range  for  a point  design  aircraft . However , if  the  normal  shock  is'  disturbed  and 
moves  to  a position  forward  of  the  throat , it  can  become  unstable  apd  "pop"  out  of 
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the  inlet . This  phenomenon  is  called  an  unstart . High  pressure  air  from  the  inlet 
is  suddenly  discharged , causing  massive  flow  disturbances  over  the  external  sur- 
faces of  the  aircraft  as  well  as  inside  the  inlet . This  results  in  strong  interactions 
between  the  engine,  inlet,  and  airframe.  Figure  4 is  a time  history  of  a double 
unstart  that  occurred  during  a turn  at  Mach  3 with  the  XB-70  airplane.  The  unstart 
was  believed  to  have  been  initiated  by  a minor  disturbance  in  the  left  inlet . The 
right  duct  unstarted  approximately  11  seconds  after  the  left  duct  as  a result  of  in- 
tervening airplane  motions . The  change  in  pressure  under  the  left  wing,  caused 
by  the  expulsion  of  the  normal  shock  forward  of  the  inlet  lip , increased  the  normal 
acceleration . The  normal  acceleration  was  further  increased  by  the  opening  of  the 
bypass  doors , which  acted  essentially  as  elevens . The  pilot  countered  this  pitch- 
ing motion  with  a longitudinal  control  input  of  approximately  3°  nose-down  eleven . 
The  unstart  and  door  movements  also  affected  lateral  control , causing  the  airplane 
to  roll  toward  the  side  that  had  unstarted.  The  pilot's  corrective  action  prevented 
the  roll  rate  from  becoming  large , but  bank  angle  changed  noticeably . From  the 
magnitude  of  the  pilot's  inputs  to  prevent  the  pitching  and  rolling  motions,  it  was 
estimated  that  the  unstart  pitching  and  rolling  moments  would  have  produced  a 2 . 5g 
steady-state  acceleration  and  a 30-degree-per-second  roll  rate.  Similarly  , loss  of 
thrust,  increased  spillage  drag,  and  the  opening  of  the  bypass  doors  during  the 
restart  cycle  caused  a longitudinal  deceleration  of  approximately  O.lg.  Perhaps 
even  more  significant  to  a passenger  on  a supersonic  transport  would  be  the  rate  of 
onset  of  acceleration,  which  was  nearly  a 0.  Ig  step  function. 

Additional  appreciation  for  these  interactive  forces  is  provided  by  the  following 
YF-12  data  (ref  . 2)  which  show  the  relative  magnitudes  of  the  accelerations  pro- 
duced by  an  unstart  and  the  aerodynamic  controls: 


L 


unstart 


3.3  deg/ sec* 


N 


unstart 


6.4  deg/see^ 


Lj.  6 ~ 30.4  deg/ sec* 

o a 
a max 


Njj  6 = -7 .3  deg/sec^ 

or 
r max 


The  effectiveness  of  the  bypass  doors  in  producing  yawing  and  rolling  accelerations 
during  normal  inlet  operation  at  Mach  3 is  shown  by  the  following  derivative  equa- 
tions (ref.  2): 
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The  propulsion  system  is  as  effective  as  the  aerodynamic  control  surfaces  in  pro- 
ducing angular  accelerations . Also , the  significant  rolling  accelerations  produced 
by  the  bypass  door  operation  indicate  that  the  moments  are  not  produced  only  by 
thrust  changes , because  the  YF-12  airplane  has  no  thrust  moment  arm  about  the 
roll  axis . 
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It  is  important  to  recognize  that  the  interaction  problem  is  not  just  one  of  sta- 
bility and  control . Interactions  can  also  seriously  affect  the  drag  and  range  per- 
formance of  an  airplane  . Figure  5 shows  the  effect  of  asymmetric  bypass  door  open- 
ing at  Mach  3 on  the  YF-12  airplane  drag  increment  expressed  as  a percentage  of  the 
basic  airplane  drag , the  vertical  fin  deflection  from  the  trimmed  condition , arid  the 
mass  flow  out  of  the  bypass  doors . Fully  opened  bypass  doors  cause  a 25-percent 
increase  in  drag  (per  engine)  and  require  15  percent  of  the  rudder  authority  to 
maintain  zero  sideslip.  At  smaller  door  openings,  a 10-percent  change  in  mass 
flow  out  of  a single  bypass  door  causes  a 2.5-pereent  increase  in  drag.  As  the  by- 
pass doors  open  beyond  40  percent,  the  mass  flow  out  of  the  doors  levels  off  be- 
cause of  a flow  choking  effect . The  similarity  of  the  drag  and  rudder  deflection 
curves  to  the  airflow  curve  Indicates  that  bypass  airflow  is  the  primary  cause  of  the 
interactions. 

The  coupling  discussed  has  been  primarily  the  result  of  direct  or  open-loop 
interactions.  A modern  aircraft,  however,  has  numerous  artificial  sensing  and 
feedback  loops  to  implement  a variety  of  control  tasks . Consequently , closed-loop 
interaction  paths  can  be  formed  that  magnify  the  open-loop  effects  or  create  new 
coupling  effects . An  example  is  shown  in  figure  6 . The  YF-12  inlet  computer  mod- 
ulates the  bypass  door  movement  as  a function  of  sideslip  (among  other  parameters) 
to  minimize  unstarts.  Because  of  the  influence  of  the  fuselage,  the  flow  at  each  inlet 
IsTiorthe  same  at  a given  sideslip  angle.  Consequently,  the  bypass  doors  are  mod- 
ulated asymmetrically,  which  produces  yawing  moments.  As  the  block  diagram  in- 
dicates , these  yawing  moments  cause  the  aircraft  to  sideslip . The  sideslip  is  sensed 
by  the  inlet  computer , which  commands  bypass  door  changes  that  produce  further 
yawing  moments . Thus  a closed-loop  path  is  formed  that  couples  the  propulsion 
system  and  the  airframe  . Because  of  lags  in  the  inlet  computer  sensing  system  , this 
coupling  is  unstable  (ref.  5)  , and  when  the  stability  augmentation  system  (SAS)  is 
turned  off  while  the  inlets  are  operating  automatically , an  unstable  Dutch  roll  motion 
results . As  illustrated  in  figure  7 , when  the  inlets  are  fixed , the  Dutch  roll  motion 
damps  out,  but  when  the  inlets  are  operating  automatically,  the  Dutch  roll  motion 
diverges . 

Another  example  of  closed-loop  airframe/propulsion  coupling  is  inlet  control  as 
a function  of  Mach  number . As  Mach  number  increases , the  YF-12  inlet  computer 
closes  the  bypass  doors,  decreasing  drag  and  increasing  thrust;  however,  this 
changes  the  variation  of  excess  thrust  with  Mach  number . The  long-period  longi- 
tudinal motion,  or  phugoid,  is  sensitive  to  variations  of  excess  thrust  with  Mach 
number  . Increases  in  excess  thrust  with  Mach  number  reduce  phugoid  damping  , as 
illustrated  in  figure  8,  which  shows  the  controls-free  altitude  response  of  the  YF-12 
airplane  to  drag  disturbances  with  the  inlets  fixed  and  the  inlets  operating  auto- 
matically . The  decreased  damping  of  the  motion  with  the  inlets  operating  auto- 
matically , in  response  to  Mach  number , is  apparent . The  large  overshoot  and 
oscillations  make  flightpath  control  difficult. 


PREDICTION 


As  the  previous  discussion  indicates , the  nature  and  magnitude  of  airframe  pro- 
pulsion interactions  were  learned  from  flight  tests;  they  were  not  predicted  . To 
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achieve  a basic  solution  to  these  problems , however , we  must  be  able  to  predict  the 
interaction  effects  so  that  they  can  be  considered  from  the  beginning  of  the  vehicle 
design.  As  part  of  the  YF-12  research  program,  wind  tunnel  tests  were  made  to 
determine  how  detailed  the  model  inlet  geometry  and  airflow  would  have  to  be  to  pro- 
vide data  from  which  the  interaction  phenomena  could  be  predicted  adequately. 

Our  first  effort  in  evaluating  prediction  techniques  was  to  qualitatively  assess  the 
similarities  of  the  local  flow  in  the  wind  tunnel  and  in  flight . In  the  wind  tunnel , oil 
was  placed  on  a 1/12-scale  model  of  the  YF-12  airplane  which  had  been  modified  to 
simulate  the  bleed  and  bypass  exits . The  exits  were  slotted  so  that  the  flow  was  ex- 
pelled at  a 15°  angle  relative  to  the  nacelle  surface , and  the  bypass  exits  were  fitted 
with  screens  to  meter  the  flow . The  mass  flow  out  of  the  bleed  and  bypass  exits  was 
varied  by  changing  the  position  of  a butterfly  valve  in  the  inlet  . The  results  of  the 
oil  flow  tests  are  shown  in  figure  9,  which  indicates  large  areas  of  separated  flow  for- 
ward of  the  bleed  and  bypass  exits  on  the  nacelle  and  extending  to  the  wing  . Be- 
cause the  bleed  and  bypass  exit  simulation  was  not  exact , it  was  questioned  whether 
this  represented  the  flow  on  the  airplane . The  exit  louvers  and  the  surrounding  area 
of  the  nacelle  and  wing  on  the  flight  vehicle  were  tufted,  and  cameras  for  photo- 
graphing the  tufts  were  installed  in  the  fuselage.  Bleed  and  bypass  mass  flow  ratios 
similar  to  those  used  in  the  wind  tunnel  were  then  evaluated  in  flight . 


Figure  10  is  a sketch  of  the  flow  field  shown  by  the  tuft  picturesT  The  separated 
regions  indicated  by  the  wind  tunnel  oil  flows  are  verified  by  the  reversed  flow  for- 
ward of  the  bypass  exits  and  the  vertical  standing  tufts  at  the  forward  edge  of  the 
separated  regions  and  on  the  bleed  exit  louvers . Thus  it  is  expected  that  when  all 
the  wind  tunnel  data  have  been  analyzed , the  results  will  agree  reasonably  well 
with  the  flight-test  data  even  though  the  exit  simulation  was  not  precise.  Force  and 
moment  tests  were  also  made  on  a 1/ 12-scale  model  with  simulated  inlet  airflow.  The 
results  of  these  tests  indicate  that  the  forces  and  moments  due  to  the  propulsion  sys- 
tem can  be  adequately  predicted  if  the  propulsion  system  is  represented  in  sufficient 
detail . 

Although  it  appears  that  wind  tunnel  data  can  adequately  predict  full-scale 
flight  results  , a general  theoretical  approach  for  predicting  these  aerodynamic  effects 
is  lacking.  Nevertheless,  by  using  wind  tunnel  tests  and  analytic  techniques,  math- 
ematical models  can  be  formulated  for  simulating  and  analyzing  airframe/propulsion 
system  coupling  problems . Care  must  be  taken  to  include  all  the  elements  that  con- 
tribute to  the  interactive  effects . 


POTENTIAL  BENEFITS 


By  using  adequate  simulation  or  analytical  models,  or  both,  that  represent  the 
entire  system  in  the  frequency  range  of  interest,  design  trade-off  studies  can  deter- 
mine the  advantages  of  integrated  or  cooperative  controls . Many  aspects  must  be 
considered  in  such  a trade-off.  For  example: 

(1)  Should  the  vehicle  be  designed  to  eliminate  interactions?  What  would  be 
the  penalty? 

(2)  Can  the  interactions  be  made  favorable? 


438 


(3)  Is  it  more  efficient  to  control  the  interactions  with  systems  than  to  redesign 
the  vehicle  configuration? 

Although  these  considerations  are  only  a few  of  the  many  that  must  be  taken  into 
account , they  are  typical  and  will  be  discussed  briefly  to  provide  some  insight  into 
the  problems . 

Should  interactions  be  designed  out  of  the  vehicle?  One  way  to  reduce  inter- 
actions is  to  bypass  air  entirely  within  the  nacelle . However , this  requires  a larger 
nacelle  diameter  which,  for  the  YF-12  airplane,  would  increase  the  nacelle  drag  by 
approximately  25  percent , Therefore  it  appears  that  it  would  be  better  to  control 
the  interactions  with  cooperative  engine/inlet  flight  controls . This  might  mean 
increased  demands  on  systems  in  terms  of  reliability  and  complexity;  however , the 
penalties  in  range,  payload,  and  performance  would  be  much  less  than  those  result- 
ing from  increasing  the  size  of  the  nacelle . 

Ideally  , the  interactiohs  would  be  arranged  to  be  complementary  . This  could 
perhaps  be  done  by  careful  placement  of  bypass  exits  or  by  means  of  the  control  laws 
in  a system  approach . As  previously  discussed , a time  lag  in  the  sideslip  sensor  for 
the  inlet  computer  resulted  in  a deerease  in  Dutch  roll  damping;  however,  the  basic 
interaction  was  favorable,  in  that  it  increased  Dutch  roll  static  stability,  that  is, 
increased  frequency. 

Figure  11  shows  the  variation  of  Dutch  roll  frequency  and  damping  as  a function 
of  sideslip  sensor  lag  and  inlet-induced  yawing  moment  for  a YF-12  type  of  config- 
uration . It  can  be  seen  that  Dutch  roll  stability  can  be  improved  by  increased  lead 
in  sensing  sideslip  and  increased  yaw  due  to  bypass  door  deflection , This  illus^ 
trates  that  the  potential  exists  for  using  airframe/propulsion  control  integration  to 
augment  the  stability  of  the  airplane , reduce  the  need  for  more  redundant  and  com- 
plex systems , and  even  reduce  the  size  of  the  aerodynamic  stabilizing  surfaces . 

The  increased  frequency  and  damping  would  make  the  airplane  more  resistant  to 
sideslip  excursions  and  allow  the  inlets  to  be  designed  with  lower  sideslip  margins 
and  thus  higher  efficiency.  Also,  performance  degradation  due  to  turbulence  might 
be  reduced , since  increased  airframe  frequency  and  damping  would  minimize  gust 
response.  These  benefits  could  be  gained  without  increasing  the  tail  size  or  the  con- 
trol system  complexity . 

The  critical  design  factor  that  determines  the  size  of  the  vertical  tail  on  a super- 
sonic cruise  vehicle  is  usually  control  of  the  aircraft  in  response  to  the  moments  in- 
duced during  an  inlet  unstart  at  maximum  Mach  number . An  integrated  control  sys- 
tem that  would  reduce  unstart  transients  through  propulsion  control  as  well  as  aero- 
dynamic control  could  result  in  significant  reductions  in  tail  size  and  commensurate 
weight  and  drag  savings.  Automatic  spike,  bypass,  and  throttle  activity  on  the 
other  nacelles  and  fast  unstart  recovery  could  greatly  reduce  the  yawing  and  rolling 
moments  and  longitudinal  decelerations  associated  with  an  unstart . 

Difficulties  are  often  experienced  with  conventional  autopilots  in  the  Mach  hold 
mode  when  an  atmospheric  temperature  disturbance  is  encountered  (ref.  6)  . The 
temperature  change  induces  an  immediate  Mach  number  change  , and  the  autopilot 
commands  large  normal  acceleration  or  altitude  changes , or  both , in  an  attempt  to 
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hold  Mach  number . Recent  studies  have  shown  that  simple  cooperation  between  the 
propulsion  and  flight  controls  through  an  autothrottle  provides  much  smoother  and 
more  accurate  response . This  is  illustrated  in  figure  12  which  shows  the  altitude , 
Mach  , and  dynamic  pressure  excursions  induced  by  a Mach  hold  autopilot  with  and 
without  an  autothrottle  in  response  to  a 4°  C atmospheric  temperature  change  . Shown 
is  the  response  of  a conventional  Mach  hold  system  in  which  pitch  angle  and  Mach 
number  are  fed  back  to  the  elevens , and  the  response  of  a system  with  an  auto- 
throttle in  which  pitch  angle  is  fed  to  the  elevens  and  Mach  number  is  fed  to  the 
throttles . The  significant  reduction  in  the  altitude  excursions  with  the  autothrottle 
system  is  evident,  whereas  Mach  control  is  essentially  equivalent.  The  autothrottle 
system  shows  the  potential  for  a 0 . 60-kilometer  reduction  in  altitude  separation  for 
air  traffic  control  purposes . 

The  altitude  excursions  in  figure  12  are  aecompanled  by  overshoots  in  dynamic 
pressure . A supersonic  airplane  usually  cruises  most  efficiently  at  the  highest 
dynamic  pressure . The  maximum  dynamic  pressure  allowable  for  normal  operation 
is  based  on  the  dynamic  pressure  limit  of  the  airplane  (for  structural  reasons)  plus 
a suitable  margin  to  allow  for  unintentional  overshoots . The  figure  shows  that  the 
autothrottle  reduces  the  dynamic  pressure  overshoot  by  3200  N/m*  . This  implies  that 
the  airplane  could  be  operated  safely  at  a correspondingly  higher  dynamic  pressure, 
which  amounts  to  approximately  a l-pereent  increase  in  cruise  range . 


Performance  gains  that  may  be  realized  by  using  a cooperative  control  system  in 
a vehicle  similar  to  the  YF-12  airplane  are  summarized  in  the  following  table: 

Payload  gain,  percent  of 
airplane  gross  weight 

Margin  reduction  — 

Inlet  stability  1.8 

Engine  temperature  ..........  2.0 


Altitude  control 1.0 

Drag  reduction  — 

Propulsion  system 1.25 

Trim  0.70 


Structural  weight  reduction  — 

Ventral  fin  . , . . ......  . . . . 0.40 

If  the  inlet  could  be  operated  with  minimum  unstart  margins  (that  is,  with  the  shock 
at  the  throat  rather  than  downstream)  , as  much  as  a 5-percent  increase  in  thrust 
could  be  realized  . This  translates  into  a 1.8-percent  improvement  in  payload  in 
terms  of  airplane  gross  weight . Similarly , improved  sensing  and  control  of  the 
turbine  inlet  temperature  rather  than  the  low  response  turbine  discharge  tempera- 
hire  could  produce  more  than  a 5-percent  increase  in  thrust  or  2 . 0 percent  in  pay- 
load.  Studies  have  indicated  that  the  elimination  of  ±600-meter  altitude  excursions 
would  allow  approximately  1 . 0 percent  increase  in  payload . 

Drag  reductions  could  be  realized  by  better  matching  of  the  inlet  and  engine 
flows  through  use  of  engine  speed  control  to  vary  the  airflow  at  off-design  operating 
conditions  of  atmospheric  temperature  and  aircraft  speed . Reduced  unstart  tran- 
sients and  improved  flight  control  could  make  possible  reduced  aircraft  stability 
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margins  , with  a resultant  payload  benefit  of  approximately  0.70  percent  for  trim  drag 
reduction  and  0 . 40  percent  for  decreased  vertical  fin  weight . Although  the  Individual 
gains  listed  may  not  be  directly  additive , they  represent  approximately  7 percent  of 
the  gross  weight  of  a typical  supersonic  cruise  airplane . If  cooperative  control  con- 
cepts were  incorporated  into  the  original  design  of  an  airplane , the  benefits  could  be 
even  greater  because  of  the  synergistic  savings  in  structural  weight  which  have  not 
been  considered  in  this  analysis . 


DESIGN  APPROACH 


The  magnitude  of  the  problem  of  integrating  the  autopilot,  stability  augmentation, 
inlet , and  engine  can  be  illustrated  by  the  matrix  of  control  options  shown  in  fig- 
ure 13 . State  variables  of  the  airplane,  inlet,  and  engine  can  be  fed  back  to  each 
control.  Typical  state  variables  include: 

Airplane  - angular  and  linear  velocities  and  accelerations,  Mach  number, 
altitude , angle  of  attack , angle  of  sideslip 

Inlet  - shock  position,  recovery,  distortion 


Engine  - rpm  , compressor  face  pressure  and  temperature,  turbine  dis- 
charge pressure  and  temperature  > 

Typical  controls  include: 


Autopilot  - elevons , rudders , servo  positions 


Inlet  - bypass  door  and  spike  position 

Engine  - power  lever  angle,  exhaust  nozzle  position,  fuel  metering  valve 

A fully  integrated  control  system  would  include  at  least  one  state  variable  feed- 
back to  each  control,  as  indicated  by  an  X in  each  square  of  figure  13(a) . In  con- 
trast , figure  13  (b)  represents  a system  with  no  integration;  that  is , there  is  no 
communication  or  cooperation  between  the  airplane,  inlet,  and  engine  controls. 
Between  these  extremes,  varying  degrees  of  integration  are  possible,  as  illustrated 
in  figures  13(c)  and  13(d)  , Figure  13(c)  is  representative  of  the  existing  YF-12 
airplane,  in  that  some  airplane  states  such  as  angle  of  attack,  angle  of  sideslip,  and 
Mach  number  are  used  to  control  the  inlet.  Figure  13(d)  could  represent  a YF-12 
airplane  with  an  autothrottle  that  used  Mach  number  to  control  the  power  lever  angle . 
Just  how  far  to  go  in  the  integration  process  will  depend  on  many  practical  as  well  as 
theoretical  considerations . 

Integrating  all  these  diverse  and  complex  factors  is  a formidable  task . Classical 
approaches  based  on  experience  and  engineering  judgment  have  been  used  . If  there 
is  a high  degree  of  interdisciplinary  coordination , classical  feedback  techniques  may 
be  adequate . The  most  promising  approach , however , may  be  based  on  optimal  con- 
trol techniques . This  approach  generally  involves  feeding  back  all  state  variables 
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and  computing  the  control  system  gains  required  to  minimize  an  appropriate  per- 
formance penalty  function  . 

When  both  classical  and  optimal  control  approaches  have  been  applied  to  the  same 
problem , the  results  have  usually  been  the  same . It  should  be  kept  in  mind , how- 
ever , that  the  classical  techniques  depend  on  analysts  and  designers  with  many  years 
of  applicable  experience . When  dealing  with  new  phenomena  involving  complex  in- 
terdisciplinary effects  such  as  airframe/propulsion  coupling  , it  may  be  difficult  or 
impossible  to  find  people  with  adequate  backgrounds  and  practical  experience  to 
handle  a classical  approach . Conversely , the  optimal  control  technique  provides  a 
systematic  approach  that  can  be  used  when  there  is  little  insight  into  the  problem . 


ONGOING  RESEARCH 


To  explore  and  validate  the  benefits  that  could  result  from  a cooperative  control 
system , analytical  and  flight  research  is  underway  at  the  NASA  Lewis  and  Flight 
Research  Centers.  The  objectives  of  this  effort  are  to  determine  the  feasibility  and 
advantages  of  a cooperative  autopilot/ S AS /propulsion  control  system  and  to  verify 
and  demonstrate  the  benefits  of  such  a system-  in  an  operational  environment . 

The  results  of  the  basic  YF-12  flight  research  program  are  being  used  in  the 
cooperative  control  program . The  pertinent  elements  of  the  basic  progrsim  include 
investigations  of  the  effect  of  airframe/propulsion  system  interactions  on  flightpath 
control,  measurement  of  high-speed  propulsion  system  performance,  and  compari- 
sons of  flight  test,  wind  tunnel,  and  simulator  results . Specifically,  wind  tunnel 
tests  to  determine  steady-state  and  dynamic  characteristics  and  to  evaluate  new  inlet 
control  concepts  have  been  made  at  Lewis  Research  Center  on  a full-scale  YF- 12 
inlet . Wind  tunnel  testing  of  a 1/  3-scale  inlet  has  been  conducted  by  Lockheed 
Advanced  Development  Projects  at  NASA  Ames  Research  Center  to  investigate  scale 
effects . Tests  have  also  been  made  at  Ames  on  a 1/ 12-scale  model  to  measure  forces 
and  moments  induced  by  inlet  airflow . Several  studies  have  been  conducted  by 
Honeywell  Inc . and  Pratt  & Whitney  to  update  existing  control  systems  and  explore 
new  control  concepts . 

The  cooperative  control  program  itself  consists  of  two  phases . The  first  phase 
is  concerned  with  longitudinal  flightpath  control,  that  is,  altitude  and  Mach  excur- 
sions . The  influence  of  atmospheric  disturbances  such  as  temperature  and  pres- 
sure changes  and  airframe  propulsion  interactions  on  longitudinal  flightpath  control 
is  being  studied . Control  laws  for  autopilots  and  stability  augmentation  systems 
that  are  less  sensitive  to  atmospheric  changes  are  being  explored . Both  classical 
and  optimal  control  techniques  are  being  used  to  define  the  control  laws . A first 
step  toward  airframe/propulsion  control  integration  will  be  taken  by  implementing 
an  autothrottle.  Figure  14  shows  the  schedule  for  the  cooperative  control  program. 
The  analytical  work  in  Phase  I was  completed  in  January,  and  an  autothrottle  is 
being  fabricated.  The  first  flight  is  planned  for  early  1975. 

Phase  II  will  consider  lateral-directional  interactions  such  as  reduced  Dutch  roll 
damping  and  unstarts . Advanced  propulsion  and  control  integration  concepts  such 
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as  optimum  cruise  control  and  unstart  control  utilizing  a digital  computer  will  be  in- 
vestigated. 

The  analytical  portion  of  Phase  II  began  recently  . Flight  tests  of  the  more 
promising  concepts  are  expected  to  begin  in  late  1975. 

A conceptual  diagram  of  the  cooperative  control  system  is  shown  in  figure  15 . 
The  digital  computer  is  used  to  compute,  coordinate,  and  command  the  functions  of 
the  inlet , engine , and  airframe  in  response  to  inputs  such  as  those  shown . 


CONCLUDING  REMARKS 


Airframe/propulsion  system  interactions  have  been  shown  to  significantly  affect 
aircraft  performance,  stability,  and  eontrol.  Changes  in  drag  as  large  as  25  percent 
(per  engine)  of  the  total  drag  can  be  involved . Forces  and  moments  as  powerful  as 
those  produced  by  the  aerodynamic  controls  have  been  observed  . If  not  accounted 
for , these  effects  can  lead  to  large  performance  degradations , large  flightpath  ex- 
cursions, and  increased  pilot  workload. 

Cooperative  or  integr^ed  operation  of  the  propulsion  and  flight  controls  may 
provide  a solution  to  these  problems . Control  integration  has  the  potential  to  not 
only  eliminate  the  adverse  effects  of  interactions  but  to  significantly  improve  per- 
formance through  synergistic  effects  such  as  less  airframe  weight , improved  flight- 
path  control,  less  overall  system  complexity,  and  more  efficient  operating  limits. 
Analytical  and  flight  research  programs  are  underway  at  the  NASA  Flight  Research 
Center  to  investigate  the  benefits  of  such  a system  in  an  operational  environment. 
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Figure  1 . Functional  nature  of  interactions 
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Figure  2.  F-104  airframe/inlet  interaction.  Yaw  damper  off 


Figure  3.  F-111  engine/inlet  interaction.  Mach  2.17. 
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Figure  4.  XB-70  engine/inlet/airframe  interaction.  Mach  3. 
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Figure  5 . Effect  of  asymmetric  bypass  door  opening  on  drag  and  directional 
control  at  Mach  3 . 
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Figure  6.  Sideslip  coupling  due  to  automatic  inlet  operation  . 
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INUTS  FIXED 


SIDESLIP 


Figure  7.  S AS -off  rudder  pulse  response  . 
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Figure  8 . YF-12  controls-free  altitude  response  to  a drag  pulse  . 


Figure  9.  Wind  tunnel  surface  oil  flow  study.  Supersonic  cruise  Mach  number; 
forward  bypass  and  bleed  open . 
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Figure  10,  Flight  tuft  study . Supersonic  cruise  Mach  number;  forward  bypass 
doors  and  bleed  open . 


Figure  11.  Effect  of  sideslip  sensor  lag  and  bypass  door  yawing  moment  on 
Dutch  roll  frequency  and  damping.  Automatic  inlet  operation. 
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Figure  12 . Mach  hold  autopilot  response . 


YF-12  simulator;  Mach  3. 
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(a)  Fully  integrated . 


(b)  No  integration  . 
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(e)  Partial  integration 
(airplane-inlet) . 


STATES 


(d)  Partial  integration 
(autothrottle) . 


Figure  13  . Options  for  control  integration. 
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Figure  14.  YF“12  cooperative  control  system  schedule  . 


Figure  15.  Cooperative  autopilot/SAS/propulsion  control  system. 
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IPCS  IMPLICATIONS  FOR  FUTURE  SUPERSONIC  TRANSPORT  AIRCRAFT 
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The  Boeing  Aerospace  Company 
J.  Kniat 

Pratt  & Whitney  Aircraft 
and 

R.  D.  Schmidt 
Honeywell  Incorporated 


SUMMARY 


The  Integrated  Propulsion  Control  System  (IPCS)  will  demonstrate  control 
of  an  entire  supersonic  propulsion  module  - inlet,  engine  afterburner,  and 
nozzle  - with  an  HDC  601  digital  computer.  The  program  encompasses  the  design, 
build,  qualification,  and  flight  testing  of  control  modes,  software,  and 
hardware.  The  flight  test  vehicle  will  be  an  F-lllE  airplane  owned  by  the 
government.  The  L.H.  inlet  and  engine  will  be  operated  under  control  of  a 
digital  computer  mounted  in  the  weapons  bay.  A general  description  and  the 
current  status  of  the  IPCS  program  are  given. 


INTRODUCTION 


The  historical  trend  of  controls  development  has  been  toward  greater 
functional  integration  to  maximize  aircraft  mission  capability.  This  trend 
will  undoubtedly  continue  as  analytical  techniques  are  refined  and  flight- 
worthy hardware  becomes  more  readily  available.  The  eventual  result  may  be 
the  integration  of  propulsion  and  flight  control  subsystems  as  diagrammed 
in  figure  1.  Until  then,  integrated  control  of  propulsion  system  components 
must  stand  on  its  own  merits.  SST  experience  convinced  Boeing  that  the 
classical  approach  to  propulsion  control  is  Inadequate,  expensive,  and  even 
hazardous  when  applied  to  high  performance  aircraft.  New  engineering  tech- 
niques must  be  developed  to  obtain  the  required  control  coordination.  New 
management  techniques  must  be  devised  to  permit  simultaneous  development  by 
various  manufacturers  of  subsystems  that  will  share  and  use  in  an  optimum 
fashion  the  information  available  to  the  total  system. 

We  are  confident  that  the  Integrated  Propulsion  Control  System  is  tech- 
nically and  economically  reasonable . The  IPCS  program  will  demonstrate  this 
feasibility  in  flight  tests  and  lay  the  groundwork  for  its  incorporation  into 
future  aircraft. 
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A discussion  of  some  key  aspects  of  the  IPCS  Program  is  given  in  this 
paper.  Since  many  forms  of  technology  are  represented  in  the  IPGS  activity, 
a complete  description  would  be  very  lengthy.  Discussion  of  some  activities 
has  been  deliberately  omitted  in  this  paper  so  that  more  space  and  time  could 
be  devoted  to  those  features  that  may  be  relevant  to  future  supersonic  trans- 
port aircraft.  This  is  consistent  with  the  goals  of  the  National  Aeronautics 
and  Space  Administration  in  conducting  the  Symposium. 


OVERVIEW 


The  Integrated  Propulsion  Control  System  (IPCS)  Program  encompasses  the 
design,  build,  flight  qualification,  and  flight  testing  of  propulsion  control 
modes,  software,  and  hardware.  The  flight  test  vehicle  will  be  an  F-lllE 
airplane  owned  by  the  government.  The  L-H  inlet  and  TF30-P-9  engine  will  be 
modified  to  operate  under  control  of  an  HDC-601  digital  computer  mounted  in 
the  aircraft  weapons  bay.  The  layout  of  the  IPCS  on  the  aircraft  is  shown 
in  Figure  2. 

The  IPCS  is  one  of  the  Exploratory  Research  Programs  funded  by  the  Air 
Force  Aero  Propulsion  Laboratory*.  Technical  support  is  being  provided  by 
NASA;  the  Flight  Research  Center  (FRC)  and  the  Lewis  Research  Center  (LeRC) . 
Major  contractors  are  Boeing  Aerospace  Company,  Hone3rwell,  Inc.,  G&AP  Division 
and  Pratt  and  Whitney  Division  of  United  Aircraft  (P&WA^) . A diagram  show- 
ing organizational  responsibilities  is  given  on  figure  3. 

The  goals  of  the  Air  Force  in  funding  the  IPCS  program  are  twofold: 

1.  Improve  aircraft  systems  performance  through  technological 
advances . 

2.  Reduce  the  cost  and  risk  of  future  development  programs  through  an 
expanded  technical  data  base  and  demonstrated  management  methodology. 

Specific  goals  established  for  the  IPCS  program  pursue  the  goals  of  the 
Air  Force  Exploratory  Development  Programs.  The  first  of  these  is  to  develop, 
demonstrate,  and  evaluate  in  a flight  environment,  certain  advanced  technical 
features  that  have  to  date  been  explored  only  under  very  restricted  conditions 
These  are  listed  in  Table  1. 

The  second  major  goal  is  the  development  of  an  intercompany  management 
approach  applicable  to  the  design  and  development  of  integrated  systems.  The 
IPCS  management  methodology  addresses  three  areas  of  potential  concern; 


Air  Force  Aero  Propulsion  Laboratory 
Air  Force  Systems  Command 
United  States  Air  Force 
Wright-Patterson  AFB,  Ohio 
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TABLE  1 


IPGS  ADVANCED  TECHNICAL  FEATURES 


Q ^ Full  authority  digital  propulsion  control  with  hydromechanical  backup. 
This  will  permit  control  law  changes  without  hardware  modification; 

o Closed  loop  control  on  turbine- inlet  gas  temperature  (TIGT) • ! 

o Use  of  compressor  discharge  Mach  number  for  surge  protection  during 

engine  transients. 

o Automatic  detection  and  suppression  of  inlet  buzz  so  that  engine  air- 
flow may  be  reduced  during  airplane  deceleration. 

o Continuous  monitoring  of  distortion  to  extend  the  operating  envelope 
with  the  compressor  surge  bleeds  closed. 

o Fuel  manifold  prefill  logic  to  smooth  afterburner  transients. 


TABLE  2 

SALIENT  FEATURES  OF  IPCS  INTERCOMPANY  MANAGEMENT  APPROACH 


o Horizontal  division  of  responsibility  - each  organization  exercises  its 
own  area  of  expertise  over  the  entire  range  of  the  program. 

o Direct  communication  at  the  working  level  is  stressed. 

o Regular  (monthly)  coordination  meetings  are  attended  by  representatives 
of  the  prime  and  major  subcontractors. 

o Periodic  working  sessions  are  conducted  with  attendance  by  technical 

personnel  of  each  of  the  three  firms.  These  meeting  sites  are  rotated. 

o Progressive  step-by-step  hardware  test  sequence. 

o Final  decisions  impacting  program  costs  or  schedule  are  made  by  the 
prime  contractor. 
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division  of  responsibilities,  communication  and  coordination  between  geograph- 
ically remote  organizations,  and  minimization  of  technical  risk  and  cost 
through  a timely  test  sequence.  The  salient  features  of  the  IPCS  management 
approach  are  listed  in  Table  2. 

Achievement  of  these  program  goals  will  identify  potential  development 
problem  areas.  It  will  generate  a body  of  technical  data  upon  which  to  base 
further  development  work  and  will  provide  a basis  for  estimating  the  time  and 
cost  of  development  of  an  operational  IPCS. 


IPCS  DEVELOPMENT  SEQUENCE 


Major  IPCS  activities  are  shown  in  figure  4.  Contract  date  was  1 March 
1973.  The  Air  Force  has  determined  that  a 36  month  program  is  compatible 
with  the  scope  of  the  program;  hence  flight  test  completion  is  scheduled  for 
29  February  1976.  (An  additional  four  months  are  allowed  for  data  reduction 
and  preparation  of  the  final  report.)  The  IPGS  schedule  was  developed  to  fit 
these  constraints. 

It  will  be  noted  that  about  half  of  the  total  program  period  is  devoted 
to  an  extensive  test  program.  This  required  careful  scheduling  of  the  analy- 
sis, design,  and  fabrication  of  hardware  and  software  to  meet  the  test  dates. 
This  requirement  influenced  the  design  procedure  to  a great  extent,  as  will 
be  discussed  later  in  this  paper. 


DATA  MANAGEMENT 


There  are  four  classes  of  data  involved  in  a program  such  as  IPCS: 

Design  data 

Hardware  and  software  checkout  data 
Data  for  test  planning  and  test  monitoring 
Test  evaluation  data  (results) 

Activity  was  initiated  immediately  after  contract  to  compile  all  avail- 
able data  on  the  characteristics  of  the  P&WA  TF30-P-9  engine  and  the  F-lllE 
inlet.  In  addition  to  published  Air  Force  and  NASA  data,  a substantial  amount 
of  unpublished  information  was  obtained  under  subcontract  from  P&WA  and 
General  Dynamics/Convair  Aerospace  Division.  These  data  were  incorporated 
into  a document  that  will  he  updated  at  6-month  intervals  as  necessary  through- 
out the  program.  Much  of  the  design  work  was  based  on  the  data  compiled  under 
this  task. 

\ The  data  compilation  discussed  above  is  being  supplemented  by  baseline 
te^ts  of  the  IPCS  engines  and  aircraft.  These  tests  also  serve  as  development 
vehicles  for  the  data  acquisition/reduction  hardware,  software,  and  procedures 
to  be  used  during  the  IPCS  flight  evaluation  program.  The  baseline  engine 
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tests  were  conducted  by  NASA/LeRC  in  their  altitude  facility.  This  test  series 
was  completed  in  February,  1974,  The  baseline  flight  tests,  to  be  conducted 
by  NASA/FRC  are  scheduled  to  begin  in  July,  1974,  The  baseline  test  program 
is  described  later  under  the  test  program  heading.  The  handling  of  the  data 
is  described  below.  It  is  anticipated  that  similar  procedures  will  be  used 
in  subsequent  system-level  tests. 


Instrumentation 

The  intent  in  selecting  instrumentation  for  the  IPCS  program  was  to 
measure  engine  and  inlet  operating  parameters  with  minimum  disturbance  to  the 
gas  flow.  Thus,  it  was  decided  that  the  only  rakes  to  be  added  to  the  flow 
path  would  be  to  measure  compressor  face  distortion  and  new  control  sisals. 
The  remaining  instrumentation  is  either  production  sensors  or  measurements  ^ 
which  can  be  made  at  the  wall  or  in  control  system  lines,  etc.  To  the  extent 
possible  the  same  or  similar  instrumentation  will  be  used  throughout  the  test 
program  to  facilitiate  data  comparisons  from  one  test  to  another].  Table  3 
lists  the  instrumentation  for  the  baseline  and  IPCS  tests, 

i 

For  the  IPCS  control  mode,  total  pressure  and  temperature  measurements 
are  required  at  the  exits  of  the  high  and  low  pressure  compressors  and  total 
temperature  is  needed  at  the  turbine  inlet.  Probe  designs  and  tl^e  required 
engine  case  modifications  for  these  probes  were  not  available  prior  to  the 
start  of  the  baseline  engine  test.  Total  pressure  and  temperature  measure- 
ments were  made  at  the  low  pressure  compressor  exit  using  probes  similar  to 
the  IPCS  design  that  could  be  inserted  through  an  existing  hole  in  the  engine 
case.  These  compressor  exit  measurements  will  not  be  made  during  the  baseline 
flight  test  since  the  IPCS  engines  will  not  be  used. 

An  unavoidable  difference  in  instrumentation  systems  exists  between  LeRC 
and  FRC.  In  the  flight  tests  there  will  be  no  steady-state  instrumentation 
equivalent  to  the  DAMPR  system  at  LeRC  during  the  IPCS  flight  test,  therefore 
data  from  the  Digital  Propulsion  Control  Unit  (DPCU)  will  be  used.  Where 
possible  the  equivalent  test  instrumentation  will  be  eliminated  to  avoid 
duplication  in  sensors  and  data  processing.  To  a degree  the  same  approach 
can  be  used  during  the  IPCS  altitude  test,  however,  during  this  test  it  will 
be  important  to  retain  sufficient  instrumentation  to  demonstrate  the  validity 
of  the  control  sensors. 


Recording 

Both  digital  and  analog  recording  systems  will  be  used  - digital  for  low 
frequency  response  data  (DC-50HZ)  and  analog  for  high  frequency  response  data 
('''500  HZ) . The  NASA/LeRC  digital  system  consists  of  a steady-state  system 
for  performance  measurement,  and  a 200  channel  low-to-medium  frequency  system 
used  for  recording  transients.  NASA/FRC  uses  a PCM  digital  system  for  both 
Steady-State  and  low  frequency  transient  data.  At  both  facilities  the  high 
frequency  data  are  recorded  on  FM  analog  systems. 
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TABLE  3 


INSTRUMENTATION 


VARIABLE 

AIRPLANE/TEST  CELL  CONDITIONS 

Frees tream  Total  Pressure 
Freestream  Static  Pressure 
CG  Long.  Accel. 

Freestream  Total  Temperature 
Wing  Sweep  Angle 
Angle  of  Attack 
Angle  of  Sideslip 

ENGINE  VARIABLES 

Total  Fuel  Flow.  Wft 
Engine  Fuel  Flow,  Wfe 
Engine  Fuel  Temperature 
Throttle  Position,  (PLA) 

RPM  (Nl) 

RPM  (N2) 

Engine  Hub  Total  Pressure,  Pt2n 

Fan  Exit  Static  Pressure,  PS13 

LPC  Exit  Static  Pressure,  PS22 

LPC  Exit  Total  Pressure,  P22 

LPC  Exit  Pressure  Differential  (P-PS)22 

HPC  Exit  Static  Pressure,  PS3 

HPC  Exit  Total  Pressure,  P3 

HPC  Exit  Pressure  Differential,  (P-PS)3 

LP  Turbine  Exhaust  Pressure  (P6M) 

Engine  Pressure  Ratio  (EP2) 

Compressor  Face  Temperature  (T2) 

HPC  Inlet  Temperature  (T22) 

HPC  Exit  Temperature  (T3) 

Turbine  Inlet  Temperature-measured  (T4) 
Turbine  Inlet  Temperature- harness  (T4H) 
Turbine  Discharge  Temperature  (T5) 
Nozzle  Area  (AJ) 

Compressor  Bleed  Switch  Positions 
Engine  Fuel  Pressure  (2) 

A/B  Fuel  Pressure  (5) 

Main  Fuel  Valve  Position 

A/B  Metering  Valve  Position  (5) 

Computer  Calculated  Parameters 


ENG  TEST 

FLT 

TEST 

B/L  IPCS 

B/L 

IPCS 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

x^ 

X 

x^ 

X 

xi 

X 

xi 

X 

xi 

X 

xi 

X 

X 

X 

X 

x^ 

X 

x^ 

X 

4 

X 

xi 

x^ 

X 

xi 

X 

x^ 

xi 

xi 

xl 

xi 

X 

xi 

X 

xi 

xi 

X 

X, 

X 

X 

x^ 

xi 

xi 

X 

xi 

X 

xj 

xi 

xi 

X 

xi 

X 

x^ 

X 

xi 

X 

x^ 

X 

xi 

X 

xi 

X 

xi 

X 

xi 

X 

X 

X 

X 

X 

X 

X 

X, 

xi 

xi 

xi 

xi 

xi 

xi 

1 Available  from  the  DPCU 
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TABLE  3 (Continued) 


ENG 

TEST 

FLT 

TEST 

VARIABLE 

B/L 

IPCS 

B/L 

IPCS 

INLET  VARIABLES 

40-Probe  Compressor  Face  Rake 

X 

X 

X 

X 

Rake  Zero  Switch 

X 

X 

X 

X 

Reference  Pressure 

X 

X 

X 

X 

Distortion  Computer  Output 

X 

X 

X 

X 

Nulling  Rake  Pressure 

X 

X 

Spike  Position 

X 

X 

Cone  Angle 

X 

^1 

Local  Mach  Pressure  Ratio 

X 

X-*- 

Duet  Mach  Pressure  Ratio 

X 

xi 

Shock  Position  Signal 

X 

Distortion  Signal 

xi 

MISC. 

Tape  Motion  Switch 

X 

X 

Event  Marker 

X 

X 

X 

X 

1 


Available  from  the  DPCU 


During  flight  tests  the  PCM  data  will  be  telemetered  to  the  ground  for 
use  in  monitoring  the  progress  of  the  test  flight.  Approximately  80  digital-* 
to-analog  converters  and  Sanborn  recorders  are  available  to  convert  the  data 
into  time  histories  during  the  flight.  There  is  no  requirement  to  telemeter 
any  of  the  analog  data  during  the  flight. 


Data  Processing 

NASA/LeRC  provided  on-line  capability  to  process  much  of  the  steady-state 
data  during  baseline  engine  tests.  The  on-line  program,  which  uses  a remote 
terminal  on  the  IBM  360,  had  the  capability  of  calculating  any  of  several 
separate  sets  of  variables.  A complete  run  of  the  program  was  made  overnight 
to  provide  the  remainder  of  the  data  by  early  the  morning  after  the  run.  In 
addition,  selected  data  were  recorded  on  oscillograph  for  use  in  running  the 
test. 


The  PCM  data  will  be  telemetered  during  the  flight  tests.  These  data 
will  be  demultiplexed  and  up  to  80  channels  will  be  displayed  on  Sanborn 
recorders  on-line,  in  real  time.  Digital  tapes  of  the  data  from  the  PCM 
system  will  be  prepared  by  NASA.  These  data  will  be  calibrated  and  will  be 
in  engineering  units.  Printouts  of  these  tapes  will  be  available  within  a 
week  of  the  flight  for  use  at  FRC. 
i 

The  FM  da]ta  are  demultiplexed  and  digitized  by  the  Boeing  Test  Data 
Processing  Center.  The  typical  data  sample  consists  of  a 200  millisecond 
interval  centered  about  an  event  such  as  a period  of  high  distortion  or 
compressor  surge.  The  pressure  signals  are  low-pass  filtered  (-3Db  at  160  Hz) 
to  retain  only  the  frequency  range  of  significance  to  the  engine.  Data  are 
digitized  at  a rate  of  1,000  samples  per  second  per  channel.  The  output 
digital  data  tape  is  converted  to  a format  compatible  with  the  CDC  6600  for 
the  remainder  of  the  processing.  The  digitized  data  are  then  processed 
through  the  distortion  routine  used  with  the  steady-state  data.  Figure  5 
presents  a t3q)ical  distortion  time  history  for  a stall  event  from  the  baseline 
test. 


The  major  differences  between  the  engine  and  flight  test  data  processing 
programs  are  in  the  input  and  output  routines  due  to  the  different  data  systems 
and  variables  being  recorded,  absence  in  the  flight  programs  of  some  engine 
calculations,  and  the  addition  of  inlet  and  airplane  computations  in  the 
flight  data  program.  Data  from  steady  flight  conditions  will  be  averaged  to 
produce  steady-state  data. 


DYNAMIC  SIMULATIONS 


D3mamic  simulations  of  the  F-111  propulsion  systems  have  formed  the 
foundation  for  the  IPCS  control  system  development  and  software  validation. 
Two  types  of  simulations  have  been  generated.  The  first  is  an  entirely 
digital  simulation  developed  for  use  on  a large  digital  computer  such  as  a 
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W.DC  6600.  The  second  is  a comprehensive  hybrid  simulation,  based  on  the 
digital  simulation,  that  was  developed  by  Honeywell.  They  incorporate  much 
of  the  system  definition  data  and  hence  form  a compact  and  convenient  reposi- 
tory for  masses  of  detailed  information.  Linear  state  models  extracted  from 
the  digital  simulation  have  been  used  to  study  control  system  stability  and 
response.  The  digital  simulation  has  been  the  principal  test  bed  for  evalu- 
ating new  control  modes.  The  hybrid  simulation  is  being  used  to  evaluate  the 
response  of  the  system  to  selected  failures  and  will  be  used  to  check  out 
both  the  digital  propulsion  control  unit  (DPCU)  and  its  software  prior  to 
shipment. 


Digital  Simulation 

The  digital  simulation  employs  the  SOAPP  system  developed  by  P&WA.  With 
this  modular  system,  most  of  the  simulation  is  created  from  routines  drawn 
from  the  SOAPP  library.  This  library  is  a major  reason  for  the  development 
of  SOAPP.  It  forms  a repository  for  up-to-date  versions  of  those  utility 
routines  that  determine  the  speed  and  accuracy  of  the  simulation. 

The  SOAPP  program  generates  both  steady-state  and  transient  engine  per- 
formance data.  This  feature  is  made  possible  by  the  application  of  a tech- 
nique called  SMITE,  originally  conceived  by  the  Air  Force  AeroPropulsion 
Laboratory.  It  uses  the  solution  to  a set  of  linearized  adjunct  equations  to 
obtain  an  iterative  solution  to  the  complex  nonlinear  equations  in  the  simula- 
tion. Steady-state  solutions  are  obtained  merely  by  setting  all  the  temporal 
derivatives  to  zero.  Figure  6 illustrates  the  simulation  adjustment.  Data 
generated  by  the  digital  program  are  compared  to  corresponding  baseline  engine 
test  data  obtained  at  NASA/LeRC.  Adjustment  improved  the  fidelity  of  the 
simulation  significantly. 


Hybrid  Simulation 

The  hybrid  simulation  of  the  propulsion  system  has  been  prepared  using\ 
two  781  EAI  analog  computers,  two  231R  EAI  analog  computers,  a PACER  16k 
digital  computer,  and  a SIGMA  5 40k  digital  computer.  The  PACER  is  used 
solely  for  generating  bivariate  functions,  for  on-line  analysis,  and  for 
problem  setup.  The  Z5  computer  is  used  to  generate  the  control  functions  and 
to  drive  a scope  display.  The  system  has  been  designed  to  run  ten  times 
slower  than  real  time  when  under  control  of  the  E5. 

Check-out  of  the  DPCU  hardware  and  software  will  be  accomplished  by 
replacing  the  E5  by  the  HDC  601  flight  computer  with  its  interface  unit  (IFU) . 
A custom  built  simulation  interface  adapter  (SIA)  will  condition  signals  from 
the  analog  computers  to  simulate  the  outputs  from  the  flight  transducers.  In 
this  service,  the  simulation  will  run  in  real  time.  All  time-dependent 
functions  are  performed  in  the  EAI  781  computers  to  facilitate  time  scale 
switching. 
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CONTROL  MODE  IDENTIFICATION 


The  DPCU  will  exercise  control  over  six  variables: 

Gas  generator  fuel  flow 

Compressor  bleeds  - 7th  and  12th  stage 

Afterburner  fuel  flow 

Exhaust  nozzle  area 

Inlet  spike  position 

Inlet  cone  position 

These  variables  must  be  adjusted  and  Goordlnated  to  provide  engine  thrust  in 
response  to  power  level  setting  while  maintaining  safe,  stall  free  operation. 
Development  of  appropriate  control  modes  was  a major  IPCS  activity. 


Gas  Generator  Fuel  Flow 

Isochronous  governing  of  N2  is  the  primary  gas  generator  fuel  control 
mode.  Steady  state  high  rotor  speed  is  a function  of  power  level  angle 
(PLA)  and  fan  face  conditions;  total  pressure  (P2)  and  total  temperature  (T2) . 
Isochronous  control  holds  thrust  more  nearly  constant  during  bleed  and  shaft 
power  extraction  than  does  droop  control.  It  also  provides  better  thrust 
response  during  part  power  excursions,  Limiting  loops  are  provided  to  over- 
ride the  N2  loop  when  required  to  protect  engine  integrity  or  operating 
stability.  Direct  measurements  are  used  for  limiting  where  available;  other- 
wise correlations  are  used.  The  limiting  loops  are  listed  in  Table  4. 


TABLE  4 


IPCS  GAS  GENERATOR  LIMITING  LOOPS 


Limited  Variable 

Low  rotor  speed 

High  rotor  speed 

Burner  Pressure 

Compressor  exit 
Mach  No. 

Airflow 

Turbine  Inlet  Temp. 


Signal  Source 
Tachometer 
Tachometer 
Pressure  transducer 
AP/P 

f (Nl/  EPR) 

Fluidic  transducer 


Purpose 

Structural  Limitation 
Structural  Limitation 
Structural  Limitation 
Stall  Prevention 

Engine/ Inlet  Compatibility 
Turbine  Overtemp  Protection 
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Compressor  Bleed  Control 

The  distortion  tolerance  of  the  TF30-P-9  engine  is  a strong  function  of 
low  rotor  speed  and  compressor  bleed  position  as  shown  by  figure  7.  The  IPCS 
test  aircraft  will  be  equipped  with  four  pressure  probes  in  the  inlet  duct. 
Distortion  will  be  inferred  from  the  output  of  these  four  probes  plus  the 
output  of  a high-response  (Kulite)  transducer  installed  in  the  NASA  test 
instrumentation  rake.  The  distortion  correlation  is  shown  in  figure  8. 

In  operation  the  engine  distortion  tolerance  will  be  compared  to  the 
sensed  distortion.  Bleed  positions  will  be  selected  as  required  to  protect 
the  engine.  The  compressor  bleeds  are  also  opened  under  certain  conditions 
at  low  power  settings  and  during  engine  deceleration  to  provide  greater 
stall  margin. 


Afterburner  Fuel  Control 

The  IPCS  modulates  afterburner  fuel  flow  in  the  afterburning  region  as 
limited  by  engine  requirements  and  the  need  to  maintain  engine/inlet  compati- 
bility. The  design  approach  was  to  use  direct  (or  synthesized)  measurements 
to  schedule  fuel  flow  and  maintain  fan  suppression  limits.  The  IPCS  schedules 
engine  stream  and  duct  stream  afterburner  fuel-air  (f/a)  ratio  as  a function 
of  a rate  limited  PLA.  This  signal  is  also  used  to  schedule  base  exhaust 
nozzle  area.  Engine  stream  airflow  is  calculated  as  a function  of  HPC  dis- 
charge pressures  and  temperature  (P3,  PS3,  and  T3) . Duct  stream  airflow  is 
obtained  from  the  difference  between  total  calculated  airflow  and  engine 
stream  airflow. 

Calculation  of  the  zone  fill  valve  timing  to  permit  prefill  of  manifolds 
is  performed  as  a function  of  a rate  limited  power  lever  angle  signal.  Zone 
fill  time,  using  flow  rates  and  manifold  volumes,  determines  the  rate  limited 
PLA  signal  at  which  the  zone  fill  valve  is  opened.  Transient  performance 
improvement  obtained  through  use  of  the  A/B  prefill  logic  is  shown  in  figure 
9.  The  IPCS  will  consistently  achieve  maximum  thrust  in  the  period  of  time 
shown  in  figure  9, 

The  normal  mode  for  maintaining  fan  suppression  is  with  the  exhaust 
nozzle  area.  This  mode  is  discussed  under  Exhaust  Nozzle  Area  Control. 

There  are,  however,  certain  regions  in  the  flight  envelope  where  the  exhaust 
nozzle  area  cannot  be  opened  further.  In  this  case  control  is  transferred 
to  the  afterburner  fuel  control  loop  to  permit  fuel  cutback  to  maintain  the 
fan  match. 


Exhaust  Nozzle  Area  Control 

The  rate  limited  PLA  that  schedules  after  burner  fuel-air  ratio  is  also 
used  to  schedule  a nominal  exhaust  nozzle  area.  This  schedule  is  set  to 
minimize  airflow  trim  requirements.  The  schedule  is  also  designed  to  force 
the  area  open  faster  when  fuel  is  added,  and  close  slower  when  the  fuel  is 
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decreased.  This  provides  a fan  operating  point  during  A/B  transients  that 
is  farther  away  from  the  stall  line,  resulting  in  a slight  under suppression. 

The  IPCS  fan  suppression  control  for  the  TF30-P-9  engine  uses  the  fan 
match  line  as  a reference  schedule  for  trimming  about  the  base  area  setting. 
An  airflow  reference  is  balanced  against  the  airflow  correlation  measurement 
to  trim  area  until  the  fan  match  is  satisfied.  If  the  fan  match  cannot  be 
satisfied  due  to  area  being  at  the  maximum  limit,  trim  authority  is  trans- 
ferred to  the  afterburner  fuel  module.  The  main  fuel  module  is  also  biased 
with  a trim  signal  received  from  the  inlet  module,  to  improve  the  off  design 
engine/ inlet  airflow  match. 


Inlet  Control 

A sketch  of  the  P-111  inlet  installation  is  shown  in  figure  10.  The 
controllable  aerodynamic  surface  is  the  spike,  which  translates  fore  and  aft. 
The  spike  surface  consists  of  two  cones;  the  second  cone  may  be  expanded  or 
contracted  over  the  range  of  8.5®  to  26®  included  angle. 

In  the  bill-of-materials  (BOM)  inlet 'control,  both  the  spike  and  cone 
positions  are  scheduled  as  functions  of  local  Mach  number  and  duct  exit  Mach 
number.  The  BOM  inlet  control  schedules  have  been  retained  for  the  IPGS. 

They  are  supplemented  by  an  anticipation  function  that  momentarily  resets 
the  surfaces  for  smoothing  the  afterburner  light-off  or  shut-down  transient. 
A buzz  detector,  based  on  that  developed  for  the  SST,  is  provided.  It 
repositions  the  surfaces  for  more  efficient  supersonic  air  spillage  when 
buzz  is  sensed.  Engine/inlet  compatibility  is  enhanced  by  an  airflow  loop 
that  shifts  both  engine  and  inlet  operating  points  slightly  to  control  the 
inlet  throat  Mach  number. 


PERFOEMAMCE/ STABILITY  TRADES 


There  is  usually  a stability  penalty  associated  with  each  performance 
improvement.  The  standard  procedure  during  a development  program  is  to 
establish  a formal  trade  study  to  determine  the  optimum  balance  between 
performance  and  stability.  A system  such  as  IPCS,  with  the  flexibility  to 
change  software  schedules  and  set  points  well  into  the  development  cycle, 
lends  confidence  to  the  trade  results  since  it  can  be  based  on  actual,  rather 
than  projected  system  performance.  For  example,  protection  of  compressor 
stability  by  sensing  compressor  exit  Mach  number  has  been  discussed  earlier. 
The  program  timing  does  not  permit  a test  series  to  develop  pressure  probes 
to  sense  internal  Mach  number.  Hence,  a tentative  compressor  exit  Mach 
schedule  will  be  programmed  into  the  software;  the  schedule  will  be  modified 
as  necessary  during  the  engine  test  program. 
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One  of  the  major  IPCS  goals  is  the  sensing  of  incipient  instability  or  i 
conditions  indicative  of  instability  so  that  operating  points  may  be  shifted  * 
as  required  for  duration  of  the  disturbance.  Three  disturbances  in  particular 
are  thus  addressed  for  the  first  time  in  a flight  test  program; 

Inlet  buzz 

Inlet  flow  distortion  j 

Afterburner  rximble  ■ 

Steady-state  inlet  distortion  was  discussed  in  the  previous  section. 

The  unsteady  component  of  distortion,  inlet  buzz,  and  afterburner  rumble  are 
each  sensed  by  eircuitS;  tuned  to  respond  to  pressute  fluctions  in  the 
frequency  ranges  of  intlerest.  The  circuit  output  increases  gradually  (with, 
e.g.,  a 0.5-second  time  constant)  when  pressure  fluctions  are  sensed  and 
decays  to  zero  when  the;  distribution  disappears . This  approach  is  based  on 
the  buzz  detector /suppressor,  developed  for  the  SST,  which  was  very  success- 
ful in  closed-loop  wind ^ tunnel  tests. 


STABILITY  ANALYTICAL  MODELS 

This  section  describes  in  broad  terms  the  methods  used  in  the  Analytical 
design  process.  The  fundamental  procedure  uses  small-perturbation  methods 
to  design  to  a series  of  operating  points  in  the  flight  envelope,  ihe 
designs  thus  developed  Will  be  programmed  for  computer  simulation.  |The 
simulation  will  then  be  subjected  to  gross  transients  over  the  entire  flight 
placard  to  verify  the  design. 

ii 

The  procedure  is  diagrammed  in  Figure  11.  It  was  designed  to  make 
maximum  use  of  existing  computer  programs  and  has  been  developed  to  provide 
the  greatest  feasible  degree  of  automation,  both  to  save  time  and  expense 
and  to  assure  consistency  in  the  application  of  design  criteria.  T^e  proce- 
dure is  as  follows; 

o Small-perturbation  methods  are  applied  to  the  digital  simulatlpn 
of  the  propulsion  system  to  linearize  about  the  desired  operating 
points. 

State  models  of  the  form 

X = Ax  + Bu;  Y = Cx  + Du 
are  generated. 

o Transfer  functions  required  for  loop-by-loop  analysis  are 
calculated  from  the  state-matrix  model. 

o Classical  linear,  constant  coefficient  design  methods  are 
used  to  develop  compensation  on  a loop-by-loop  basis. 
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The  above  steps  are  performed  for  a series  of  operating  points 
to  obtain  the  relationships  between  compensation  parameters  and 
engine  burner  pressure,  Polynominals  are  generated  to  describe 
the  relationships. 

o The  compensation  polynominals  are  programmed  into  the  nonlinear 
(SOAPP)  simulation  and  subje&ted  to  standard  disturbances  over 
the  flight  envelope. 

o Adjustment  is  made  and  the  process  is  repeated  if  necessary. 

In  lieu  of  classical  design  specs,  the  following  criteria  have  been 
established  as  golas  to  be  used  in  controller  compensation  design: 

o Phase  margin  of  all  loops  shall  be  at  least  65“ . 

o Gain  margin  of  all  loops  shall  be  at  least  6db. 

o Loops  designated  as  limiting  (maximum  or  minimum)  shall  have 
no  overshoot  when  subjected  to  a step  input. 

o Where  overshoot  is  permitted,  overshoot  shall  not  exceed  the 
value  attained  under  BOM  control  as  predicted  by  the  SOAPP 
simulation. 

o Rise  time  of  each  loop  shall  be  as  fast  as  the  value  attained 
under  BOM  control. 

o Settling  times  of  variables  shall  not  exceed  settling  times 
attained  by  the  SOAPP  simulation  under  BOM  control. 

For  some  of  the  IPGS  control  loops  there  are  no  analogous  loops  in  the 
BOM  controller.  Time  domain  specs  for  these  loops  are  based  on  engineering 
judgement  of  what  is  required  to  attain  good  servo  response.  All  loop  com- 
pensations designed  by  linear  single  input/single  output  methods  are  verified 
using  the  non-linear  SOAPP  simulation. 

SOFTWARE  DEVELOPMENT 


Efficient  software  is  crucial  to  the  success  of  a program,  such  as  IPGS, 
that  employs  a digital  computer  as  the  central  element  of  a control  system. 
Furthermore,  it  is  a large-budget,  long-lead-time  item.  Esoteric  by  nature 
and  unspectacular  compared  to  high-technology  hardware,  software  has  been  a 
source  of  much  grief  to  the  unwary.  In  view  of  these  factors,  a significant 
portion  of  the  IPGS  effort  has  been  devoted  to  software  development. 
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Two  sets  of  software  are  being  developed  for  the  IPCS  program;  a digital 
representation  of  the  bill-of-material  hydromechanical  control  (B0MDIG)  and 
the  computer  implementation  of  the  control  modes  discussed  earlier  in  this 
paper  (IPCS) . The  software  is  organized  in  modular  form,  which  is  consistent 
with  the  requirements  of  this  program;  since  both  sets  of  software  will  drive 
the  same  engine  hardware.  Since  most  of  the  sensors  are  common,  many  of  the 
subroutines  are  common  to  the  two  programs.  The  software  is  being  programmed 
for  the  Honeywell  HDC  601  computer,  which  is  a 16~bit  machine  with  a 16k 
military  core.  Characteristics  of  this  machine  may  be  found  in  the  literature. 

Memory  and  timing  estimates  for  the  two  programs  are  listed  in  Table  5. 

The  factor  that  may  appear  unique  to  the  engine  control  is  the  large  number 
of  functional  relationships  that  are  stored  as  tables.  Table  5 indicates 
that  42%  of  the  B0MDIG  memory  requirement  is  devoted  to  data  storage.  Deleting 
that  portion  of  the  data  base  that  deals  with  initialization,  input,  output, 
etc.,  it  is  found  that  BOMDIG  requires  about  3600  locations  for  tables  while 
the  IPCS  algorithm  requires  about  6700  locations. 


TABLE  5 


MEMORY  & TIMING 

ESTIMATE  OF 

CONTROLLERS 

FOR  THE  IPCS  PROGRAM 

BOMDIG 

IPGS 

SUBROUTINE 

MEMORY 

(WORDS) 

TIME 

(MSEC) 

MEMORY 

(WORDS) 

TIME 

(MSEC) 

EXECUTIVE 

1400 

2.84 

1400 

2.84 

SENSOR  PROCESSING 

1300 

4.74 

1300 

4.74 

CONTROL  SUBROUTINE 

6500 

8.25 

8300 

14.66 

OUTPUT  PROCESSING 

450 

1.48 

450 

1.48 

COMPUTER  PROGRAM 
DATA  BASE 

750 

- 

750 

- 

10400 

17.31 

12200 

23.72 

+550 

+0.86 

+600 

+1.17 

(42%  Data) 

(61%  Data) 
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Since  the  IPCS  is  an  R&D  effort,  tasks  such  as  BITE  and  redundancy  do 
not  comprise  a large  portion  of  the  computing  effort.  There  is  a sample 
problem  within  the  executive  subroutine  to  check  the  computer  function.  The 
outputs  of  sensors  critical  to  flight  safety  are  tested  to  determine  whether 
th[e  signals  are  within  the  normal  operating  range.  If  a failure  that  might 
result  in  damage  to  the  engine  is  sensed  in  this  manner,  control  is  trans- 
ferred to  the  hydromechanical  fuel  control,  which  is  retained  as  a backup 
in  this  program.  Figure  12  diagrams  the  IPCS  Fail  Safe  provisions.  There 
are  in  addition  some  synthesized  signals  that  will  be  used  as  replacements 
if  the  input  goes  out  of  the  normal  operating  range. 

Sampling  periods  of  20  milliseconds  and  30  milliseconds  for  the  BOMDIG 
and  IPGS  algorithms,  respectively,  are  based  upon  the  timing  estimates  shown 
in  Table  5.  Because  program  schedule  limitations,  no  particular  effort  has 
been  made  to  simplify  the  IPCS  control  functions.  Neither  has  any  effort 
been  devoted  to  determining  which  functions  could  be  sampled  at  intervals 
longer  than  the  basic  sampling  period.  In  view  of  this,  it  is  estimated 
that  an  optimized  IPCS  control  of  the  future,  without  BITE  and  engine  health 
monitoring  added,  would  require  about  11,300  words  of  memory  and  have  a com- 
putational time  requirement  of  20.6  milliseconds. 

In  Other  digitally  controlled  systems  where  reliability  is  a major  con- 
sideration (Space  Shuttle  Engine  Control  and  some  flight  control  systems), 
a rule  of  thumb  has  been  that  the  control  subroutine  time  requirement  should 
be  increased  by  a factor  of  three  to  include  reliability  needs.  Under  this 
assumption,  the  cpntrol  subroutine  computational  time  would  be  44  milli- 
seconds. This  number  suggests  that  additional  computer  capability  is  required 
to  cope  with  the  expanded  work  load. 


The  most  attractive  solution  appears  to  be  to  apportion  the  control  tasks 
to  a number  of  parallel  processors  that  are  essentially  identical  to  achieve 
reduced  production  costs  through  higher  volume.  This  option  can  be  exercised 
only  if  care  is  taken  to  provide  adequate  communication  between  subcontrollers 
so  that  true  control  integration  can  be  achieved. 


TEST  PROGRAM 


A sequence  of  hardware  tests  will  be  conducted  to  evaluate  the  IPCS. 

This  series  is  progressing  from  baseline  evaluation  of  the  existing  system 
in  a low  risk,  step-by-step  manner  through  flight  evaluation  of  the  IPCS. 

The  test  flow  is  diagrammed  in  figure  13.  This  test  program  provides  high 
confidence  of  success  at  each  phase  due  to  the  gradually  increasing  complexity 
of  the  tests. 
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Baseline  Tests 


Baseline  engine  and  flight  tests  are  designed  to  document  the  performance 
of  the  F-111E/TF30-P-9  system  prior  to  the  IPCS  modifications.  The  baseline 
engine  test  has  been  completed.  During  this  test  the  two  engines  to  be  mod i-~ 
fied  for  IPCS  were  tested  over  a range  of  flight  conditions  to  establish 
steady-state  and  transient  performance  and  distortion  tolerance.  Data  from 
the  test  have  been  analyzed  and  used  to  update  the  d3mamic  simulation.  The 
baseline  flight  test  will  provide  similar  data  for  the  airplane  and  inlet. 


Subsystem  Tests 

Individual  component  performance  and  physical  integrity  will  be  demon- 
strated, where  necessary,  through  component  and  subsystem  tests.  Individual 
components  will  be  subjected  environmental  tests,  temperature  cycling  and 
vibration  in  particular,  as  required  by  the  NASA  specifications.  The  DPCC 
hardware  and  software  will  be  thoroughly  checked  out  prior  to  shipment  from 
the  Honeywell  facility  as  indicated  earlier  under  "Hybrid  Simulation." 

The  control  software  will  be  loaded  into  the  HDC  flight  computer  and  tested 
in  real  time  with  the  loop  closed  by  the  hybrid  simulation.  The  flight  con- 
ditions to  be  explored  are  sea  level  static  and  three  Mach  numbers  at  45,000 
feet:  0.9,  1.6,  and  2.1.  A full  complement  of  power  transients  will  be  exe- 
cuted. Typical  flight  disturbances  will  be  presented  to  the  system.  The 
effect  of  transducer  failure  will  be  evaluated  by  disconnecting  the  signal 
lines  to  simulate  failure.  This  extensive  in-house  test  program  will  drastic- 
ally reduce  the  number  of  "bugs"  encountered  during  subsequent  system-level 
testing  and  will  thereby  effect  significant  savings  in  both  cost  and  calendar 
time. 


Closed-Loop  Bench  Test 

A comprehensive  closed-loop  bench  test  will  follow  the  component  tests. 
The  TF30  fuel  controls,  modified  to  incorporate  electrical  interfaces,  will 
be  installed  in  the  P&WA  fuel  bench  test  facility.  A schematic  of  the  test 
set-up  is  shown  in  figure  14.  The  flight  DPCU  will  be  connected  to  the  fuel 
controls  through  electrical  cables  of  length  chosen  to  simulate  the  aircraft 
installation.  The  inlet  actuators,  with  their  position  feedback  transducers 
will  be  installed  in  a jig,  supplied  with  hydraulic  power,  and  connected  to 
the  DPCU.  Analog  simulations  of  the  engine  and  the  inlet  aerodynamics  will 
be  provided  to  close  the  loops  and  generate  the  signals  that  would  be  sensed 
by  transducers  in  the  aircraft.  In  some  cases,  simulation  interface  adapters 
will  be  provided  to  simulate  the  transducer  output  format.  This  test  will 
provide  a functional  check  out  of  the  modified  fuel  control  unit  and  will 
establish  compatibility  between  the  DPCU  and  its  software  and  the  engine  and 
inlet  control  hardware. 
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Sea  Level  Static  Test 


The  second  test  of  the  series  will  be  a sea  level  static  (SLS)  engine 
test,  also  conducted  at  the  P&WA  facility.  The  modified  fuel  controls  will 
be  installed  on  the  modified  TF-30  engines  which  will  be  mounted  on  a test 
stand.  This  test  will  provide  the  first  opportunity  to  demonstrate  IPCS 
operation  with  the  engine  and  will  permit  the  necessary  fine  tuning  prior  to 
the  altitude  test.  The  SLS  test  will  also  serve  as  the  acceptance  test  for 
the  IPCS  and  the  modified  engines. 


Altitude  Facility  Test 

The  altitude  test  at  NASA/LeRC  will  duplicate  most  of  the  operating  con- 
ditions scheduled  for  investigation  during  the  IPCS  flight  tests.  Operation 
of  the  IPCS  will  be  refined  at  points  throughout  the  flight  envelope,  again 
using  an  analog  inlet  simulation.  The  NASA/LeRC  "puff-jet''  distortion  gener- 
ator will  be  used  to  create  disturbances  to  check  operation  of  the  IPCS  buzz 
suppression  and  distortion  loops.  Following  the  altitude  test,  the  modified 
engine  and  DPCU  will  be  installed  in  the  airplane  for  a flight  evaluation  of 
the  IPCS  operation. 

The  installation  of  the  IPCS  on  the  flight-test  aircraft  will  be  per- 
formed by  NASA/FRC.  All  electrical  cables  on  the  aircraft  will  be  fabricated 
by  FRC  to  drawings  supplied  by  the  contractor.  Following  installation,  a 
thorough  check-out  and  ground  test  will  be  conducted. 


Flight  Test 

A six-month  Flight  test  evaluation  of  the  IPCS  is  scheduled.  The  tenta- 
tive flight  test  points  are  shown  figure  15.  Test  planning  has  not  been  com- 
pleted at  this  writing.  It  is  anticipated,  however,  that  the  projected  26 
flights  (approximately  50  flight  hours)  will  provide  sufficient  time  to 
evaluate  all  of  the  IPCS  features  under  a variety  of  conditions. 


CONCLUSIONS  AND  RECOMMENDATIONS 


Since  the  IPCS  program  is  not  quite  half  completed  as  this  is  written, 
firm  conclusions  are  premature.  It  is  possible,  however,  to  submit  tentative 
conclusions  based  on  experience  to  date.  These  are  offered  below  subject  to 
the  qualification  that  they  may  be  modified  as  further  experience  is  gained . 

1.  Basing  the  bulk  of  the  controls  analysis  on  a detailed  digital  simulation 
of  the  propulsion  system  was  a sound  approach.  A digital  computer  tape 
is  a convenient  and  compact  way  to  transmit  masses  of  technical  detail. 
This  approach  also  assured  consistency  between  analytical  work  performed 
by  each  of  the  three  major  contractors. 
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2. 


Many  delays  were  experienced  during  baseline  engine  testing  due  to 
shortages  of  electrical  power  to  operate  the  facility.  If  energy  shortages 
prove  to  be  persistent,  new  approaches  to  test  operation  may  be  necessary. 
In  particular,  more  rapid  methods  of  establishing  test  conditions,  instru- 
mentation that  minimizes  time  spent  on  condition,  and  data  reduction 
methods  that  correlate  data  collected  under  slightly  different  test  con- 
ditions would  alleviate  the  problem  significantly. 

3.  Computer  software  is  an  item  whose  importance  can  scarcely  be  overstated. 
There  appears  to  be  a tendency  in  the  industry  to  underestimate  lead  time 
and  overestimate  the  flexibility  of  software.  Once  constructed  and  checked 
out,  software  is  almost  as  difficult  to  change  as  hardware.  The  principal 
difference  is  that  software  does  not  have  to  be  vibrated  to  demonstrate 
mechanical  integrity, 

4.  Standardized  methods  for  transmitting  information  between  airborne  digital 
machines  are  essential  if  the  full  potential  of  digital  electronics  is 

to  be  realized.  The  centralized  super  computer  that  performs  all  calcula- 
tions aboard  the  aircraft  appears  to  be  unfeasible  throughout  the  foresee- 
able future.  Sets  of  small  machines  operating  in  parallel  are  practical 
and  economical,  provided  the  communication ’problem  is  solved. 

Although  IPCS  hardware  has  not  been  discussed  in  depth,  some  comments 

are  in  order; 

1.  Electromechanical  and  electro hydraulic  interface  devices  must  be  selected 
very  carefully  to  minimize  electrical  and  electronic  problems.  From  an 
electronics  standpoint,  for  example,  torque  motors  are  preferable  to  stepper 
motors,  linear  variable  differential  transformers  (LVDTs)  are  preferable 
to  resolvers  for  position  sensing, 

2.  Transducers  will  continue  to  present  problems  throughout  the  foreseeable 
future.  Controls  engineers  must  make  a determined  effort  to  design  out 
of  the  system  the  requirement  for  high  accuracy  and/or  high  response. 
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Figure  1:  Integrated  FI ight/Propulsion 
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Figure  2:  Integrated  Propulsion  Control  System 


Figure  3:  IPCS  Organization 
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Figure  4:  IPCS  Development  Sequence 


Figure  5:  Distortion  Time  History, 

Baseline  Engine  Test 
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REPRODUGBILITY  OF  THF 


Figure  6:  Comparison  of  Baseline  Engine  Data  with 
Simulation  at  30,000  Ft.  Mach  0.8. 
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Figure  7:  Compressor  Bleed  Operation 
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Figure  8:  Steady  State  Distortion  Correlation 
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Figure  9:  Military  to  Maximum  Afterburner  Transient 
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DETAIL  C SIMILAR  DETAIL  A 

Figure  10:  F-111  Inlet  Installation  Figure  11:  Analytical  Design  Procedure 


Figure  14:  I PCS  Closed- Loop  Bench  Test  Schematic 
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Figure  15:  iPCS  Flight  Test  Envelope 
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A DIGITAL  COMPUTER  PROPULSION  CONTROL  FACILITY  - 
DESCRIPTION  OF  CAPABILITIES  AND  SUMMARY  OF 
EXPERIMENTAL  PROGRAM  RESULTS 

John  R,  Zeller,  Dale  J,  Arpasi,  and  Bruce  Lehtinen 
NASA  Lewis  Research  Center 

SUMMARY 

Flight-weight  digital  computers  are  being  used  today  to  carry  out  many  of  the  pro- 
pulsion system  control  functions  previously  delegated  exclusively  to  hydromechanical 
controllers.  An  operational  digital  computer  facility  for  propulsion  control  mode  studies 
has  been  used  successfully  in  several  experimental  programs  at  the  Lewis  Research 
Center,  This  paper  describes  the  system  and  some  of  the  results  thus  far  obtained. 
These  results  are  concerned  with  engine  control,  inlet  control,  and  inlet- engine  integrat- 
ed control.  Analytical  designs  for  the  digital  propulsion  control  modes  include  both 
classical  and  modern/optimal  techniques. 


INTRODUCTION 

With  each  advancement  in  integrated-circuit  technology,  the  reliability  of  electronic 
digital  computers  designed  for  use  in  severe  aircraft  environments  improves.  As  a re- 
sult, flight-weight  digital  computers  will  be  used  to  carry  out  more  and  more  of  the  pro- 
pulsion control  functions  now  being  handled  by  continuous  hydromechanical  controllers. 
Flight-weight  digital  computer  controllers  have  already  been  selected  for  operational 
flight  applications  as  a full- authority  supersonic  inlet  control  and  as  a supervisory  con- 
trol on  an  afterburning  turbofan  engine.  In  addition  to  operational  flight  applications,  a 
gener  air  purpose  electronic  digital  computer  controller  can  greatly  simplify  the  develop- 
ment of  control  modes  for  advanced  airbreathing  propulsion  systems.  The  many  schedul- 
ing and  logical  manipulations  necessary  in  the  control  of  complex  high-performance 
propulsion  systems  are  well  suited  to  the  capabilities  of  a digital  computer.  Control 
modes  can  be  easily  implemented  in  software  and  checked  out  without  actual  flight  hard- 
ware development. 

Because  of  the  benefits  of  a general-purpose  digital  computer  for  propulsion  control 
mode  development,  the  Lewis  Research  Center  put  into  operation  several  years  ago  the 


A 


BLANS  NOI? 


477 


Digital  Computer  Propulsion  Control  Facility  for  developing  advanced  propulsion  con- 
trol modes.  It  is  designed  to  permit  real-time,  on-line  implementation  of  controls  for 
various  configurations  of  airbreathing  propulsion  systems  operating  in  sea- level,  alti- 
tude, and  wind  tunnel  test  facilities. 

This  paper  describes  the  capabilities  of  this  facility  as  they  relate  to  the  require- 
ments of  propulsion  system  control  mode  research  and  discusses  various  test  programs 
in  which  this  digital  facility  was  used  successfully.  First,  the  Digital  Computer  Pro- 
pulsion Control  Facility  in  use  at  the  Lewis  Research  Center  is  described  in  detail. 

Next,  the  various  programs  in  which  the  facility  was  employed  as  an  active  control  sys- 
tem are  briefly  described.  The  results  obtained  from  the  various  programs  are  then 
summarized.  These  results  include  data  related  to  such  things  as  inlet  shock- position 
control  and  engine  fail- operational  control.  Finally,  some  of  the  present  activities  in 
this  area  are  discussed  and  future  areas  of  investigation  for  digital  propulsion  control 
recommended. 


DIGITAL  computer  PROPULSION  CONTROL  FACILITY 
Design  Considerations 

The  Digital  Computer  Propulsion  Control  Facility  was  designed  to  provide  versatile 
control  of  airbreathing  propulsion  systems  including  (1)  inlet  control,  such  as  shock- 
position  regulation  and  restart  scheduling;  (2)  engine  control  to  provide  thrust  and 
specific-fuel-consumption  optimization  under  operational  restrictions;  and  (3)  combined 
inlet- engine  interaction  optimization. 

The  prime  considerations  in  the  design  of  the  computer  control  facility  were  overall 
signal  processing  speed  and  computational  capacity.  The  system  must  be  capable  of 
accepting  the  necessary  system  inputs,  processing  them,  and  outputting  the  commands 
within  the  frequency  range  of  the  propulsion  system  dynamics.  For  example,  inlet  con- 
trol generally  requires  a high  rate  of  control  command  updates  but  relatively  few  mea- 
surements and  calculations.  On  the  other  hand,  engine  control  does  not  generally  re- 
quire a high  rate  of  control  command  updates  but  could  entail  the  measurement  of  many 
engine  parameters  and  could  require  extensive  control  computations. 

System  processing  speed  is  a function  of  computer  computational  speed  and  the  ver- 
satility of  the  input-output  structure.  Computational  speed  is  maximized  through  the  use 
of  an  efficient  programming  language  and  a fast-response-time  computer.  Computer  re- 
sponse time  is  denoted  by  memory  cycle  time,  which  is-the  time  it  takes  to  read  and  re- 
store a computer  word  in  memory.  T3?pical  memory  cycle  times  of  real-time  computers 
presently  available  range  from  a fraction  of  a microsecond  to  a few  microseconds.  Pro- 
gramming languages  become  less  efficient  as  they  are  removed  from  the  basic  machine 
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language.  The  most  efficient  language  offers  a one-to-one  correspondence  with  machine 
language.  This  language  is  generally  called  assembly  language.  The  versatility  of  the 
assembly  instruction  set  is  of  prime  importance  in  the  selection  of  a digital  computer 
for  purposes  of  control. 

The  input-output  structure  should  require  a minimum  of  machine  computation  time. 
Direct  automatic  transfer  of  blocks  of  data  to  and  from  computer  memory  on  a cycle- 
stealing basis  is  necessary.  This  method  causes  disruption  of  the  computation  process 
for  only  one  machine  cycle  per  word  of  data  transferred. 

In  addition  to  these  internal  equipment  considerations,  external  characteristics  of 
the  digital  control  equipment  were  also  a consideration.  Control  development  is  best 
done  with  the  aid  of  comprehensive  analog  or  hybrid  siniulations  of  the  propulsion 
system.  Since  long- line  communication  between  the  Lewis  simulation  laboratory  and  all 
the  planned  propulsion  test  areas  did  not  originally  exist,  portability  of  the  digital  con- 
trol equipment  was  a requirement. 


■General  Facility  Description 


The  digital  computer  controller  is  made  up  of  several  distinct  units: 

(1)  A digital  computer  designed  for  real-time  control  applications 

(2)  A digital  interface  capable  of  converting  both  analog  and  frequency  signals  to 
computer- compatible  digital  words  and  converting  computer-generated  words  to 
analog  and  logical  outputs 

(3)  Programming  peripherals  consisting  of  a high-speed,  paper-tape  reader  and 
punch  and  a teletype 

(4)  A signal  processing  unit  (SPU)  which  provides  signal  conditioning  and  monitoring, 
as  well  as  some  analog  computation  capability,  between  the  digital  interface  and 
the  propulsion  system  to  be  controlled 

The  digital  computer,  the  digital  interface,  and  the  programniing  peripherals  were  sup- 
plied as  a system  from  a digital  computer  manufacturer.  The  signal  processing  unit 
was  assembled  at  Lewis  from  purchased  components. 

The  system,  excluding  the  teletype,  is  housed  in  five  distinct  racks  (fig.  1)  requiring 
approximately  3.  4 running  meters  of  floor  space.  Intercabinet  cabling  is  accomplished 
in  the  rear  and  allows  a maximum  of  3. 05  meters  of  spacing  between  adjacent  cabinets. 
The  system  was  designed  to  be  portable.  Typical  tear  down  and  setup  time  is  1 day,  and 
complete  system  checkout  requires  1 week 

The  block  diagram  of  figure  2 illustrates  the  basic  units  and  interconnection  of  the 
digital  control  system.  All  signals,  to  and  from  the  propulsion  system,  pass  through 
the  signal  processing  unit  (SPU) . 
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The  SPU  will  accept  high  level  (-fclO  V range)  analog  signals  already  amplified  and 
signal  conditioned  from  standard  pressure  transducers  and  thermocouples.  It  will  ac- 
cept frequency  signals  directly  from  flowmeters  and  magnetic  speed  transducers.  Sys- 
tertx  outputs  may  be  directed  to  proportional  electrohydraulic  servosystems  or  on-off 
types  of  devices.  These  serve  as  the  control  inputs  to  the  propulsion  system  manipulat- 
ed variables.  The  SPU  was  designed  to  increase  flexibility  in  the  calibration  and  opera- 
tion of  the  control  system.  In  particular,  the  SPU  provides 

(1)  Ground  isolation  between  the  facility  and  the  control  unit 

(2)  Signal  filtering 

(3)  Analog  computation  for  propulsion  system  simulation  or  generation  of  time- 
dependent  control  functions 

(4)  Flexibility  in  signal  routing  between  the  facility  and  the  control  unit 

(5)  Calibration  of  the  system 

(6)  Comparators  and  signal  conditioners  for  use  with  priority  interrupts 

(7)  Signal  monitoring 

Figure  3 illustrates  the  SPU  cabinet  layout  and  its  equipment  complement. 

The  digital  interface  consists  of  a high-level,  analog  signal  acquisition  unit;  a fre- 
quency signal  acquisition  unit;  an  analog  signal  output  unit;  a logical  output  unit;  and  an 
external  priority  interrupt  processor.  The  digital  interface  communicates  with  the  com- 
puter on  either  a single-word  or  a block- data- transfer  basis.  The  programming  peri- 
pherals communicate  only  by  single -character  transfer.  The  signal-processing  capa- 
bility of  the  system  is  given  in  table  I.  Table  II  contains  a complete  list  of  specifications 
for  the  computer  and  digital  interface  equipment. 

The  computer  itself  is  programmed  through  the  use  of  paper  tape.  The  system  in- 
cludes a high-speed,  paper-tape  reader  and  punch.  The  reader  operates  at  300  charac- 
ters per  second  and  punches  at  110  characters  per  second.  One  character  consists  of 
eight  binary  bits.  Paper  tapes  may  be  generated  on  an  ASR  35  teletype  and  may  also  be 
read  into  the  computer  by  this  unit. 

A more  detailed  description  of  the  complete  digital  computer  facility  is  given  in 
reference  1. 


Digital  Propulsion  Control  Programs 

The  Digital  Computer  Propulsion  Control  Facility  just  described  has  been  in  opera- 
tion at  Lewis  for  approximately  4 i years.  The  facility  has  been  used  continuously 

2 

throughout  that  period.  The  experimental  programs  in  which  it  has  been  utilized  for 
propulsion  control  mode  research  are  summarized  as  follows: 

(1)  Mixed- compression  experimental  inlet  in  the  10-  by  10- Foot  Supersonic  Wind 
Tunnel:  High-performance  shock-position  and  restart  control  studies  using  both 
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classical  and  modern  control  design  techniques 

(2)  Full- authority  digital  computer  control  of  a turbojet  engine  in  a sea- level  test 
stand:  Bill- of- material  control  modes  with  prediction  techniques 

(3)  Full-scale  symmetric,  mixed-compression  inlet  in  the  10-  by  10- Foot  Super- 
sonic Wind  Tunnel:  Digital  implementation  of  bill- of- material  control  modes  as 
well  as  research  control  modes 

(4)  Fail-operational  type  of  turbojet  engine  controller:  Evaluation  in  sea-level  test 
stand 

(5)  Integrated  engine-inlet  control:  Mixed- compression  inlet  and  afterburning  turbo- 
fan engine  in  the  10-  by  10- Foot  Supersonic  Wind  Tunnel 

In  each  of  these  experimental  programs,  the  software  implementations  of  the  digital 
propulsion  control  laws  were  checked  out  and  debugged  with  real-time  aaalog  simulations 
of  the  inlet  and/or  engine.  This  activity  was  carried  out  with  the  computer  equipment 
located  in  the  simulation  laboratory.  In  the  early  experimental  programs,  the  equip- 
ment would  then  be  physically  moved  to  the  control  rooms  of  the  experimental  facilities. 
The  most  recent  programs,  though,  have  employed  a c.entral  location  (simulation  labor- 
atory) and  communicated  with  the  process  being  controlled  via  underground  long- lines. 
This  approach,  using  appropriate  line-driving  electronics,  has  been  highly  successful 
even  for  distances  of  some  450  meters.  Cable  communication  is  available  at  Lewis  be- 
tween the  computer  facility  location  and  the  10-  by  10-Foot  Supersonic  Wind  Tunnel  and 
the  four  altitude  tanks.  Since  programs  planned  for  the  near  future  involve  only  these 
experimental  facilities,  the  central  location  approach  will  be  in  effect  for  some  time. 
Such  an  approach  permits  double  duty  for  the  facility,  with  simulation  evaluation  of  con- 
trols taking  place  on  one  shift  and  experimental  evaluation  taking  place  on  another  shift. 

In  the  following  section,  some  of  the  results  obtained  in  the  digital  propulsion  con- 
trol studies  are  discussed. 


DIGITAL  PROPULSION  CONTROL  RESULTS 
Digital  Inlet  Control 

The  Digital  Computer  Propulsion  Control  Facility  was  first  used  for  direct  digital 
control  of  an  experimental  mixed-compression  inlet  in  the  10-  by  10- Foot  Supersonic 
Wind  Tunnel.  The  function  of  the  controls  research  was  to  evaluate  shock- position  con- 
trol techniques  as  well  as  restart  control  concepts.^  A complete  description  of  the  test 
program  and  its  results  is  contained  in  reference  2.  A brief  summary  of  the  results  is 
included  in  this  paper. 

The  inlet  was  equipped  with  a translating  centerbody  and  high-response  overboard 
bypass  doors  as  the  control  inputs.  The  shock-position  controller  was  configured  as 
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shown  in  the  block  diagram  of  figure  4,  The  purpose  of  the  control  design  was  to  mini-^ 
mize  shock  motion  caused  by  downstream  airflow  disturbances.  Thus,  it  was  to  function 
as  a shock-position  regulator.  Classical  control  design  techniques  (root  locus  analysis) 
were  used  to  arrive  at  an  acceptable  inlet-shock-position-regulator  control  law.  The 
continuous  control  law  arrived  at  was  integral  in  nature,  with  some  additional  lead- lag 
compensation.  The  integral  control  law  was  first  implemented  with  electronic  analog 
computer  components,  and  experimental  frequency  response  performance  was  obtained. 

Figure  5 shows  the  open-  and  closed-loop  frequency  response  of  the  normalized 
amplitude  ratio  of  inlet  shock  position  (as  measured  by  a static  pressure  downstream  of 
the  throat)  to  an  airflow  disturbance  as  a function  of  the  frequency  of  the  downstream 
disturbance,  (For  brevity,  only  the  amplitude  responses  are  shown. ) The  solid  curve 
is  the  open- loop  or  uncontrolled  amplitude  characteristic.  The  aihplitude  ratio  of  the 
shock  motion  to  a downstream  airflow  disturbance  for  this  and  all  future  frequency  re- 
sponse curves  has  been  normalized  to  the  steady-state,  open- loop  amplitude  ratio.  As 
shown  in  figure  5,  the  amplitude  ratio  responds  about  1:1  to  about  5 hertz.  Beyond  this, 
it  starts  to  attenuate  but  does  display  a resonance  at  50  to  60  hertz.  The  closed- loop 
performance  of  the  continuous  integral  controller  is  shown  by  the  dashed  curve  of  fig- 
ure 5,  Low-frequency  shock  motion  is  greatly  attenuated  by  the  integral  control  action. 
Thus,  low-frequency  downstream  airflow  disturbances  have  little  effect  on  shock  position, 
The  various  system  phase  lags,  however,  cause  the  control  action  to  quit  at  about 
5 hertz.  In  fact,  with  the  gain  selected,  the  controller  actually  amplifies  shock  motion 
above  that  of  the  open- loop  or  uncontrolled  case  from  5 to  20  hertz.  Beyond  20  hertz, 
response  behaves  as  if  the  control  had  no  effect.  Assuming  most  large- magnitude  air- 
flow disturbances  to  be  low  frequency  in  nature,  this  control  behavior  is  acceptable. 

In  order  to  evaluate  the  effects  of  using  the  digital  computer  system  for  direct  con- 
trol, the  integral-shock-regulator  control  law  was  converted  to  a discrete-time  equiva- 
lent by  using  Z-transform  techniques.  The  resulting  algorithm  was  programmed  into 
the  digital  computer  control  system,  and  the  experimental  closed- loop  results  of  fig- 
ure 6 were  obtained.  Two  different  sample  rates  or  control  update  intervals  (1000  sam- 
ples/sec and  100  samples/sec)  were  evaluated.  The  results  as  shown  in  figure  6 were 
not  too  different  from  those  of  the  continuous  controller,  but  some  slight  degradation  in 
response  did  occur  when  using  only  100  samples  per  second. 

In  the  future,  the  advantages  of  having  a digital  computer  within  the  control  loop 
may  lead  to  the  use  of  adaptive  control  techniques.  Here  the  control  algorithms  may  be 
such  that  controls  gains  will  be  determined  on  line  as  the  process  varies,  and  the  com- 
plexity of  the  control  gain  computation  will  become  of  importance.  Therefore,  the  per- 
formance of  a simple  finite  difference  approximation  (backward  difference  method  of 
ref.  2)  to  the  continuous  control  law  was  compared  with  the  performance  of  the  more 
complicated  Z-transform  algorithm.  A frequency  response  comparison  as  shown  in 
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figure  7 was  made  at  the  slower  rate  of  100  samples  per  second.  Some  degradation  does 
occur  with  the  backward  difference  approximation,  but  performance  is  still  tolerable. 


Digital  Inlet  Control  (Modern  Control) 

During  the  test  program  just  described,  efforts  were  made  to  study  the  merits  of 
modern  or  optimal  control  theory  when  applied  to  the  shock-position-regulator  problem. 
This  study  and  the  experimental  results  obtained  therein  are  described  in  detail  in  ref- 
erence 3,  A brief  summary  of  the  approach  taken,  as  well  as  some  selected  results, 
is  contained  in  this  paper. 

The  design  of  the  shock  regulator  was  begun  with  the  selection  of  a quadratic  per- 
formance index  which  minimized  the  expected  frequency  of  inlet  unstarts  created  by  a 
random  downstream  {compressor  face)  airflow  disturbance.  The  spectral  density  of  this 
disturbance  assumed  the  majority  of  the  energy  to  be  at  low  frequencies.  A noisy  mea- 
surement of  the  sensed  shock  position  was  also  assumed.  The  controller  structure, 
therefore,  had  the  optimal  regulator  - state  estimator  configuration  described  by  the 
block  diagram  of  figure  8.  The  problem  was  formulated  as  a continuous  controller,  and 
thus  a discrete  equivalent  had  to  be  generated  for  use  with  the  digital  computer  control- 
ler. The  technique  by  which  this  was  done  is  discussed  in  detail  in  an  appendix  to  ref- 
erence 3 and  is  not  repeated  herein. 

The  block  diagram  of  figure  9 shows  the  various  elements  which  comprise  the  digital 
computer  implementation  of  the  modern  or  optimal  shock-position  regulator.  The  dis- 
crete optimal  regulator  - state  algorithm  did  not  permit  the  system  to  be  sampled  less 
frequently  than  1000  samples  per  second.  The  sampled- data  system  became  unstable  if 
sampling  less  than  once  every  1 millisecond  was  attempted. 

Figure  10  compares  the  closed-loop  frequency  response  performance  for  the  dis- 
crete optimal  control  with  the  continuous  version  implemented  with  analog  computer  com- 
ponents, The  curves  show  the  normalized  amplitude  ratio  of  shock  position  to  the  dis- 
turbance airflow  against  frequency.  As  shown  in  figure  10,  there  is  very  little  differ- 
ence between  the  analog  and  digital  control  performance.  The  curves  show  that  the  low- 
frequency  shock  motion  is  attenuated,  which  is  similar  to  the  integral  control  action  of 
the  classical  inlet  control  design.  The  optimal  regulator  has  been  forced  to  this  type  of 
response  by  the  nature  of  the  spectral  density  of  the  disturbance  (most  of  the  energy  at 
the  low  frequencies). 

It  should  be  emphasized  at  this  point  that  the  frequency  response  results  of  figure  10 
are  included  only  to  show  that  a complicated,  continuous,  optimal  regulator  - state 
estimator  control  law  could  be  discretized  for  use  in  a digital  computer  sampled-data 
system.  The  exact  discretization  demanded  the  1000-sample-per-second  rate.  No  effort 
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was  made  to  develop  control  law  simplifications  which  would  reduce  the  required  saui- 
pling  rates.  , 


Digital  Turbojet  Engine  Control 

The  capabilities  of  digital  computers  for  turbojet  engine  control  were  investigated 
with  a J85-GE-13  engine  in  a Lewis  sea- level  test  stand.  The  computer  system  was 
programmed  to  implement  the  continuous  bill- of- material  control  laws  in  a discrete 
fashion.  Figure  11  compares  the  time  responses  of  several  engine  variables  for  a throt- 
tle step  from  idle  to  military  using  the  continuous  intact  hydromechanical  controller  with 
those  using  the  discrete  digital  computer  control.  Although  only  an  update  interval  of 
2 milliseconcte  (500  samples/sec)  is  shown  in  the  figure,  identical  transient  performance 
was  obtained  at  update  intervals  to  25  milliseconds  (40  samples/sec).  Beyond  25  milli- 
seconds, the  speed  response  began  to  become  oscillatory.  In  figure  11  it  can  be  seen 
that  the  digital  control  (solid  curves)  responds  slightly  faster  than  the  hydromechanical 
controller  (dashed  curves).  This  slight  difference  was  determined  to  be  due  to  some 
small  differences  between  the  nominal  control  schedules  programmed  in  the  computer 
and  the  actual  cam  schedules  in  the  specific  hydromechanical  controller  used. 

Using  the  Lewis  digital  system,  the  controller  could  sample  measured  control  vari- 
ables, compute  the  control  algorithm  using  these  sampled  measurements,  and  output 
commands  in  an  elapsed  time  of  about  1,  4 milliseconds  (1400  /xsec').  The  sequence  of 
operations  is  diagramed  in  figure  12,  The  sequence  was  initialized  with  a priority  in- 
terrupt from  an  interval  timer.  As  shown  in  the  figure,  the  total  control  computation 
takes  approximately  1,  408  milliseconds  (1408  /isec).  If  the  system  is  updating  every 
2 milliseconds  (2000  jusec),  there  will  be  0.  6 millisecond  (600  /nsec)  of  idle  time 
available  between  interrupts.  At  a 25-millisecond  update  interval  though,  the  computer 
would  be  busy  only  6 percent  of  the  time.  This  ’’spare  time”  might  be  necessary  if  the 
computer  would  also  be  recpired  to  compute  a complicated  inlet  control  law  and  to  up- 
date the  inlet  every  5 milliseconds  or  so. 

Looking  ahead  then,  to  the  time  when  the  computer  might  be  asked  to  do  many  more 
on-line,  real-time  tasks  other  than  inlet  and  engine  control,  methods  for  reliably  ex- 
tending control  update  intervals  were  investigated.  The  curves  \of  figure  13  show  some 
of  the  results  of  this  investigation.  A prediction  algorithm  was  selected  and  applied  to 
the  sampled  measurements.  This  technique  permitted  engine  transient  performance  at 
150- millisecond  updates  to  closely  match  the  2- millisecond  performance  without  pre- 
diction, Essentially,  the  prediction  algorithm  uses  the  present  measurement  and  past 
measurements  to  determine  the  trend  or  direction  in  which  particular  measured  vari- 
ables are  headed.  It  can  then  predict  what  the  variable  might  be  at  some  time  during  the 

484 


interval.  It  then  uses  the  predicted  value  at  some  selected  instant  within  the  interval  to 
compute  the  controller  inputs  to  the  engine.  The  complete  details  of  this  engine  digital 
controls  research  activity  are  documented  in  reference  4.  Also  included  is  a complete 
description  of  the  experimental  equipment  needed  to  accomplish  electronic  engine  con- 
trol. 

Fail- Operational  Digital  Engine  Control 

A digital  engine  control  study  was  carried  out  in  the  sea-level  test  stand  to  utilize 
the  extensive  computational  and  decision  making  potential  of  the  digital  computer  to  per- 
form new  control  functions  not  attainable  with  state-of-the-art  hydromechanical  control- 
lers, The  concept  studied  was  termed  fail- operational  control.  Its  purpose  was  to  de- 
velop a controller  able  (1)  to  detect  failures  in  certain  specific  sensed  engine  measure- 
ments, (2)  to  adapt  to  these  failures,  and  (3)  to  continue  to  provide  engine  operation 
with  as  little  performance  degradation  as  possible. 

In  this  first  attempt  at  implementing  a fail- operational  control,  only  the  sensed 
measurements  of  engine  rotor  speed  and  compressor-discharge  static  pressure  were 
considered  as  candidates  for  possible  failure.  These  are  two  primary  measurements 
used  in  the  J85-GE-13  bill- of- material  control  law.  The  fail-operational  system  Was  de- 
signed to  operate  with  either  or  both  of  the  two  sensors  failed.  This  investigation  is  de- 
scribed in  reference  5,  A brief  description  of  the  system  and  the  experimental  resulte 
obtained  using  it  are  contained  in  the  next  few  paragraphs. 

The  basis  of  the  fail- operational  control  is  the  fact  that  the  compressor-discharge 
static  pressure  Pg  and  engine  rotor  speed  N are  very  strongly  dependent  on  one  an- 
other because  of  the  inherent  cycle  characteristics  of  the  turbojet  engine.  Figure  14  is 
a plot  of  this  relation  during  normal  steady- state  operation  as  well  as  during  accelera- 
tions and  decelerations.  The  data  are  for  speeds  from  idle  to  military  (full  100  percent 
speed)  and  were  taken  at  sea- level  static  conditions.  The  computer  was  programmed  to 
store  a representation  of  this  characteristic  in  memory  for  use  during  a fail- operational 
control  condition. 

A generalized  block  diagram  of  the  fall- operational  control  is  presented  in  figure  15. 
The  sensor  measurements  of  engine  rotor  speed  N and  compressor-discharge  static 
pressure  pg  are  brought  into  the  computer  controller  through  its  normal  sampling 
mechanism.  Before  the  sampled  measurement  is  used  in  the  normal  engine  control  al- 
gorithm, however,  a failure- detection  algorithm  is  applied  to  each.  If  a failed  sensor  is 
detected,  for  pressure  pg  for  instance,  the  control  logic  will  switch  from  the  incorrect 
measured  value  of  pg  to  a stored  value  of  pg  representative  of  compressor -discharge 
exit  static  pressure  at  the  speed  at  which  the  engine  is  operating.  The  normal  engine 
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control  algorithm  will  then  be  exercised,  using  the  unfailed  speed  measurement  and  the 
modeled  pg  pressure  value.  The  control  will  also  use  the  throttle- input  and 
compressor-face  temperature  and  pressure  measurements. 

As  shown  in  figure  14,  the  speed- pressure  characteristic  is  double  and  even  triple 
valued  at  the  high  end.  This  characteristic  is  due  to  exhaust  nozzle  motion  caused  by 
the  turbine-discharge-temperature  override  control  loop,  which  is  standard  on  the 
J85-GE-13  engine.  In  order  to  avoid  this  multivalued  condition  and  to  be  able  to  put  re- 
alizable characteristic  functions  into  the  computer  memory,  the  normal  bill- of- material 
control  was  modified  slightly.  A limit  was  imposed  on  the  minimum  allowable  exliaust 
nozzle  area  such  that  the  temperature  override  would  not  be  activated.  Also,  a limit 
was  placed  on  the  maximum  throttle  position  that  the  control  would  accept.  Admittedly, 
these  limits  sacrificed  some  thrust  capability,  but  they  did  permit  a straightforward 
approach  to  computer  modeling  and  storage  of  the  engine  speed- pressure  characteristic. 
The  actual  data  that  were  tabulated  in  meniory  for  use  in  the  fail- operational  control  are 
shown  on  figure  16.  Data  of  Speed  against  pressure  and  pressure  against  speed  are  re- 
dundant information,  but  both  are  stored  in  the  computer  to  simplify  the  retrieval  from 
memory. 

One  of  the  innovations  of  the  computer  algorithms  developed  in  this  fail- operational 
investigation  is  that  a self-teaching  feature  was  developed  for  modeling  the  speed- 
pressure  charaeteristics.  The  control  was  designed  to  start  from  a crude  generalized 
engine  characteristic  for  a J85-GE-13,  Then,  with  all  sensors  operating,  the  control 
could  teach  itself  the  exact  data  for  the  engine  being  controlled.  The  system  would  re- 
quire both  a slow  and  a fast  throttle  transient  to  generate,  in  memory,  data  similar  to 
those  in  figure  16,  In  this  way  the  system  operated  with  actual  engine  characteristics 
rather  than  precalculated  nominal  or  average  values  for  the  whole  family  of  J85-GE-13 
engines.  A detailed  discussion  of  the  fail- operational  control  is  given  in  reference  5. 

Figure  17  shows  the  response  of  the  engine  rotor  speed  for  a throttle  step  from  idle 
to  military  power  setting  under  both  normal  control  and  fail-operational  control.  Cases 
for  either  a compressor  pressure  or  engine  speed  sensor  failure  are  shown,  (Note  that 
speed  information  for  this  data  is  obtained  from  speed  instrumentation  distinct  from  the 
control  speed  sensor  whose  failure  is  being  simulated, ) In  these  curves  it  was  assumed 
that  the  individual  sensor  failures  were  detected  prior  to  the  start  of  the  transient. 
Transient  responses  in  which  the  individual  sensor  failed  during  the  transient  were  also 
taken  and  operation  was  identical  to  figure  17.  For  either  type  of  failure,  correspond- 
ence to  normal  control  is  good.  However,  because  throttle  limits  were  built  into  the 
algorithm,  the  speed  under  fail- operation  control  does  not  quite  reach  full  military  speed. 
Likewise,  the  thrust  response  curves  of  figure  18  show  that  thrust  also  is  limited  by  a 
small  amount  at  either  condition  of  fail- operational  control.  This  limitation  is  due  to 
lower  speeds  and  the  fact  that  the  exhaust  nozzle  area  was  prevented  from  going  fully 
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closed  to  avoid  the  turbine- discharge- temperature  override  which  would  modilate  the 
area. 

Simultaneous  failures  of  both  the  speed  and  pressure  sensors  were  accommodated 
in  the  fail- operational  control.  Detection  of  a double  sensor  failure  put  the  normal  en- 
gine control  into  a throttle-rate-limit  mode.  In  this  mode,  regardless  of  the  throttle 
input  from  the  outside,  the  controller  would  schedule  engine  operation  per  a setected 
rate  of  change,  of  throttle  position  until  the  final  throttle  input  was  achieved.  Figure  19 
shows  the  response  under  the  double- sensor -failure  condition.  Speed  response  from 
idle  to  military  is  about  30  seconds.  The  throttle  rate  limit  was  selected  conservatively 
to  demonstrate  computer  control  capability.  No  attempt  was  made  to  optimize  the  re- 
sponse under  double  failures. 


Inlet-Engine  Digital  Integrated  Control 

The  Lewis  Digital  Computer  Propulsion  Control  Facility  was  most  recently  employ- 
ed in  the  control  integration  of  an  e3q)erimental  supersonic  mixed- compression  inlet  and 
a TF-30/P-3  afterburning  turbofan  engine.  This  experimental  program  is  the  subject  of 
a paper  to  be  presented  at  this  session  by  Mr.  P.  Batterton  and  therefore  is  not  dis- 
cussed herein.  A detailed  discussion  of  that  work  is  contained  in  reference  6. 


Present  Activities 

At  the  present  time  the  computer  facility  is  being  employed  to  study  digital  control 
of  advanced  turbofan  engines.  The  engines  presently  are  simulated  in  real  time  on  the 
Lewis  hybrid  computer  system,  and  new  modes  of  control  using  a digital  computer  are 
being  evaluated.  These  are  complete  wide-range  simulations  of  operation  at  many  alti- 
tude and  Mach  number  conditions.  In  conjunction  with  this  effort,  experimental  programs 
in  the  altitude  test  facilities  are  being  planned  to  verify  the  control  concepts  being  stud- 
ied. 


CONCLUDING  REMARKS 

If  we  consider  the  Lewis  Digital  Computer  Propulsion  Control  Facility  as  a tool  for 
propulsion  control  mode  studies  regardless  of  the  future  type  of  hardware  implementation 
of  the  control,  the  past  4 years  have  been  highly  successful.  The  ability  to  assess  con- 
trol concepts  and  then  simply  modify  software  to  investigate  other  control  approaches 
has  greatly  expedited  our  research  activittes. 
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K we  consider  the  digital  facility  as  a predecessor  of  the  type  of  control  hardware 
that  will  actually  be  available  for  future  operational  propulsion  systems,  much  valuable 
information  has  been  learned.  First,  a modern  digital  control  computer  operating  as  a 
sampled-data  system  can  definitely  perform  the  control  task  for  a complete  supersonic 
airbreathing  propulsion  system.  Modern  computers  are  certainly  fast  enough  and,  equip- 
ped with  sufficient  memory  capacity,  can  perform  tasks  previously  considered  impracti- 
cable. 

Much  more  work  remains  to  be  done  to  ensure  that  new  digital  control  laws  can  be 
reliably  executed  under  the  ever-changing  requirements  and  conditions  that  a propulsion 
system  encounters  in  an  operational  flight  ^plication.  Some  of  these  potential  problems 
can,  with  careful  planning,  be  attacked  in  ground  test  facilities  and  with  sophisticated 
simulations.  The  utilization  of  the  Lewis  Digits  Computer  Propulsion  Control  Facility 
is  directed  toward  this  end.  Other  problems  will  have  to  be  solved  with  flight  programs 
such  as  the  F-111  IPCS  and  YF- 12  cooperative  control  activities. 
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TABLE  !.  - SIGNAL  PROCESSING  CAPABILITY 


Present 

complement 

Fully 

expanded 

Signal  inputs  from  propulsion  system 

100 

100 

Signal  outputs  to  propulsion  system 

. 54 

54 

Analog- to -digital  conversion  channels 

64 

64 

Period-to -digital  conversion  channels 

10 

20 

Logical  outputs 

64 

64 

Digital-to -analog  conversion  channels 

26 

42 

External  priority  interrupt 

lb 

22 
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TABLE  n.  - FACILITY  SPECIFieATIONS 


Digital  computer 


Magnetic  core  memory  size,  words  . . , 
Word  length,  bits  plus  parity  ...... 

Memory  cycle  time,  nsec . . 

Add  time,  usee  . 

Subtract  time,  /isec  . 

Multiply  time,  jusec  . . . ...  . . . . . 

Divide  time,  Msec  

Load  time,  /xsec 

Store  time.  Msec  . . , 

Indirect  addressing 

Indexing 

Priority  interrupts  . 

Index  registers: 

Independent 

In  conjunction  with  lower  accumulator 
Physical  size,  cm  (in.): 

Width 

Height  . ..............  . 

Depth  


......  16  384 

. . . . ....  .16 

........  750 

. . . . . . . . 1.5 
i .". ..  : „.  ‘iv5 
........  4.  5 

. . . . . . . 8.25 

. . . . . ...  1.5 

. . . . . . . . 1.5 

......  Infinite 

. . Total  memory 
28  Separate  levels 

1 

. 1 

. . . . . 60.9  (24) 
....  157.  4 (62) 
. . . . . 76.2  (30) 


Interval  timers 


Complement  ...... 

Accuracy,  clock  pulses 
Clock  rates,  kHz  . . . . 

Counter . . 

Output 


2 

±1 

572,  286,  160,  143,  80,  71.5,  40,  35.75,  20,  10 

16-Bit  binary 

. . . . Priority  interrupt  to  computer 

Analog  acquisition  imit 


Number  of  multiplexers,  digitizers, 

and  sample  and  holds  . 

Overall  sample  rate  (maximum),  kHz  . . 
Resolution  of  digital  data,  bits  ...... 

Output  code  

Number  of  channels  ........... 

Input  range,  V (full  scale)  

Input  impedance,  MSI  (shunted  by  10  pF) 

Maximum  source  resistance,  ^ 

Conversion  time.  Msec  . . . 

Input  settling  time.  Msec  . ........ 

Sample-and-hold  aperture  time,  nsec  . . 
Safe  input  voltages,  V . . 

Total  error  with  calibration,  percent  . . 


. 2 

40 

. . . . . . . .12  (plus  sign) 
. . . . . Two’s  complement 

. . . . . . 64 

. ±10 

.10 

............  1000 

. . 38 

. . . 9 

500 

........  ±20  sustained 

±100  for  less  than  100  Msec 
...........  0.073 
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TABLE  n.  - Concluded.  FACILITY  SPECIFICATIONS 


Frequency  acquisition  unit 


Number  of  channels  ........ 

Nature  of  input  ....  . ..... 

Resolution  of  digital  data,  bits  . . 
Switch  selectable  clock  rates,  kHz 
Overall  accuracy,  bits  . . . . . . 
Update  rate  ............ 

Maximum  input  frequency,  kHz  . 
Input  amplitude  range  . • • • • • • 


Analog 


output  unit 


................  .10 

Continuously  varying  or  pulsatile 

................  .12 

. . . 20,  80,  100,  400,  external 

............  . . . . .±1 

Once  per  cycle  of  input  frequency 
............  . ....  1 

. . . 100  mV  to  30  V peak  to  peak 


Total  number  of  digital -to -analog 

conversion  channels  . . . 

Resolution  (tO  channels),  bits  . . 

Resolution  (16  channels),  bits  ". 

Output  voltage  range,  V full  scale  . . 

Output  current  (maximum),  mA  

Output  impedance,  . . . 

Accuracy  (12  bit),  percent  of  fuU  scale  

Accuracy  (13  bit),  percent  of  full  scale  . 

Slew  rate,  V/jusec  . 

Settling  time  for  10 -V  step  to  within  0. 05 

percent  of  final  value,  /isec  


.....  26 
12  (plus  sign) 
11  (plus  sign) 
.....  ±10 

10 

.....  <1 
....  ±0.1 
. . . ±0.05 

......  1 

20 


Logical  output  unit 


Number  of  electronic  switch  outputs . 32 

Number  of  contact  closure  outputs  . 32 

Maximum  voltage,  V .......................  . . 30 

Maximum  current,  mA  . 100 


Priority  interrupt  processor 


Number  of  channels  ... 
Input  impedance,  kf2  . . 
Input  voltage  range,  V . 
Comparator  switching . . 
Comparator  hysteresis  . 
Comparator  output,  V . . 
Monostable  multivibrator: 
Pulse  width,  Msec  . . 
Pulse  height,  V . . . . 


10 

47 


................  ±10 

....  . Trigger  on  rise  or  fall 

Adjustable  from  35  mV  to  650  mV 
.±7 


3 

±7 


Figure  1.  - Digital  computer  propulsion  control  facility. 


Figure  2.  - Block  diagram  of  digital  control  facility. 
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Figure  5.  - Comparison  of  experimental  c^en -loop  and  closed-loop  frequency  response  of  normalized  amplitude  ratio  of  shock 
position  to  airflow  disturbance. 
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Figure  6.  - Comparison  of  experimental  closed-loop  frequency  response  performance 
using  analog  computer  control  and  z-transform  digital  computer  control  at  two 
different  sampling  rates. 


Figure  7.  - Comparison  of  experimental  closed-loop  frequency 
response  for  z-transform  and  backward  difference  digital 
computer  algorithms  using  sample  rate  of  100  samples  per 
second. 
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Figure  8.  - Block  diagram  of  combined  optimal  regulator  - state  estimator.  (Symbols  used 
are  conventional  modern/optimal  control  notation.) 
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Figure  9.  - Block  diagram  of  digital  computer  inlet  control  system. 
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Figure  10.  - Comparison  of  closed-loop  experimental  frequency  responses  of  shock 
position  to  disturbance  airflow  amplitude  ratio  using  analog  and  digital  computer 
implementations  of  optimal  regulator  - state  estimator  control  law. 


Figure  11.  - Comparison  of  digital  and  hydromechanical  controls  for  throttle  step  from  idle 
to  military. 
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Figure  12.  - Timing  diagram  for  typical  upda^  interval. 


Figure  13.  - Effects  of  prediction  on  engine  response  for  throttle  step  from  idle  to  military. 


Engine  rotor  speed,  N,  percent 


Figure  14,  - Compressor-discharge  static  pressure  as  function  of 
engine  rotor  speed  for  normal  digital  controL 


To  engine 


Figure  15.  - Block  diagram  of  fa  1 1 -operational  control. 
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Figure  16.  - Plot  of  tabulated  values  of  compressor-discharge  static  pressure  and  en 
gine  rotor  speed  as  functions  of  each  other  for  fail-operational  control  programs. 


Figure  17.  - Step  responses  of  engine  rotor  speed  from  idle  to  100  percent 
rotor  speed  for  normal  digital  control  and  engine  rotor  speed  and 
compressor-discharge  static  pressure  P3  fail -operational  controls. 
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Figure  18.  - Step  responses  of  engine  gross  thrust  from  idle  to  IK)  percent  rotor 
speed  for  norma!  digital  control  and  engine  rotor  speed  N and  compressor- 
discharge  static  pressure  P3  fail -operation  controls. 


Time,  sec 


Figure  19.  - Step  response  of  engine  rotor  speed  from  idle  to  100  percent  rotor 
speed  for  combined  engine  rotor  speed  N and  compressor-discharge  static 
pressure  P3  fail -operational  control. 


501 


N76-31135  PART  2 


I 


3110 


DESCRIPTION  AND  TEST  RESULTS  OF  A DIGITAL  SUPERSONIC  PROPULSION 


SYSTEM  INTEGRATED  CONTROL 


Peter  G.  Batterton,  Dale  J.  Arpasl,  and  Robert  J.  Baumbick 
NASA  Lewis  Research  Center 

SUMMARY 

A digitally  implemented  integrated  inlet/engine  control  system  was  developed  and 
tested  on  a mixed-compression,  Mach  2.  5,  supersonic  inlet  and  augmented  turbofan  en- 
gine. The  control  matched  engine  airflow  to  available  inlet  airflow  so  that  in  steady 
state,  the  shock  would  be  at  the,  desired  location  and  the  overboard  bypass  doors  would  be 
closed.  During  engine  induced  transients,  such  as  augmentor  lights  and  cutoffs,  the  inlet 
operating  point  was  momentarily  changed  to  a more  supercritical  point  to  minimize  un- 
starts. The  digital  control  also  provided  automatic  inlet  restart. 


INTRODUCTION 


Advanced  propulsion  systems  such  as  those  found  in  the  B-1,  F-14,  and  F-15  are 
quite  complex.  As  future  supersonic  transport  aircraft  are  designed,  the  propulsion 
systems  of  those  aircraft  will  require  control  systems  even  more  complex  than  those 
found  in  current  aircraft.  Some  aspects  of  these  supersonic  propulsion  system  control 
problems  are  discussed  in  references  1 to  4.  This  increase  in  complexity  has  led  to  an 
upsurge  in  interest  in  digital  controls  for  advanced  propulsion  systems  because  of  the  in- 
herent flexability  of  the  digital  computer. 

There  has  been  little  actual  experience  with  the  combination  of  a turbofan  engine  and 
mixed-compression  supersonic  inlet.  This  is  the  first  experimental  test  in  the  United 
States  to  study  the  interactions  of  such  a system,  and  to  determine  its  controlability. 
Several  difficulties  can  arise  from  the  use  of  such  combinations  in  the  area  of  overall  re- 
liability and  efficiency,  and  in  providing  sufficient  stable  operating  range  for  the  inlet 
while  minimizing  the  probability  of  engine  stall. 

There  are  several  inter-related  control  problems  for  this  engine  and  inlet.  Any 
changes  in  augmentor  operation  will  result  in  temporary  changes  in  fan  airflow.  An  ex- 
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an^le  of  an  airflow  disturbance  for  an  augmentor  llght-off  Is  shown  In  figure  1.  This  Is 
a result  of  the  fact  that,  at  the  high  Mach  numbers,  the  fan  operating  point  Is  generally 
at  a low  corrected  speed  op  the  fan  operating  map.  Relatively  large  airflow  changes  can 
therefore  result  from  small  changes  In  fan  pressure  ratio.  These  airflow  changes  can 
cause  Inlet  unstarts  if  of  sufficient  magnitude  and  If  the  rate  of  change  Is  outside  the  con- 
trol bandwidth  of  the  Inlet  terminal  shock  control  system.  An  Inlet  unstart  that  was 
caused  by  an  augmentor  llght-off  transient  Is  shown  In  figure  2.  The  unstart  causes  a 
rapid  dropoff  In  the  fan  Inlet  pressure  with  a corresponding  drop  In  propulsion  system 
thrust.  This  occurs  while  the  terminal  shock  Is  being  e3q>elled  from  the  Inlet.  The  en- 
gine compressor  Is  also  stalled  by  this  pressure  disturbance.  Also  shown  In  figure  2 Is 
the  Indicated  turbine  Inlet  temperature.  This  temperature  shows  approximately  15  per- 
cent Increase  over  the  Initial  value  with  the  Inlet  unstart  and  engine  stall.  This  could 
possibly  overtemperature  the  engine  In  actual  flight,  but  that  did  not  occur  during  testing 
because  of  low  engine  Inlet  temperatures.  During  the  restart  of  the  inlet,  high  distortion 
is  generated.  This  may  cause  a second  engine  stall  and  this  is  shown  in  the  figure.  The 
unstart  problem  would  be  less  apt  to  occur  if  the  inlet  terminal  shock  could  be  positioned 
further  downstream  in  the  inlet  throat  providing  greater  margin  against  an  unstart.  But 
this  results  in  poor  inlet  pressure  recovery  (poor  efficiency)  and  greater  distortion  at 
the  engine. 

This  project  was  imdertaken  to  determine  the  nature  of  a control  system  such  that 
the  aforementioned  problems  could  be  avoided  or  at  least  minimized  and  at  the  same  time 
minimize  overboard  spillage  of  inlet  capture  air.  The  approach  taken  was  to  tie  together 
the  inlet,  engine,  and  augmentor  control  systems  in  an  appropriate  manner  so  as  to: 
first,  in  steady  state,  monitor  inlet  shock  position  and  overboard  bypass  door  command 
and  adjust  engine  airflow  to  match  available  inlet  airflow;  second,  for  augmentor  induced 
transients,  provide  information  to  the  inlet  and  engine  control  systems  which  can  be  used 
to  prevent  inlet  unstart  and/or  engine  stall;  and  third,  provide  automatic  restart  should 
the  inlet  unstart.  Since  there  was  considerable  logic  involved  in  this  type  of  control  sys- 
tem and  since  much  experience  has  already  been  gained  in  the  use  of  digital  computer 
control  of  supersonic  inlets  (ref.  5)  and  of  an  augmented  engine  (ref.  6) , it  was  decided 
that  this  control  would  be  implemented  on  a digital  computer.  This  is  the  first  attempt 
at  simultaneously  controlling  both  a supersonic  inlet  and  engine  with  the  same  digital 
computer.  It  was  also  felt  that  this  choice  would  provide  support  material  for  the  Air 
Force-NASA  cooperative  digital  integrated  control  flight  program  (ref.  7)  now  under 
contract. 
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SYMBOI^ 


Njj  high  rotor  speed,  rpm 

Nj^  low  rotor  speed,  rpm 

p 

P total  pressure,  N/cm 

2 

p static  pressure,  N/cm 

T total  temperature,  °C 

Wj  fuel  flow,  kg/sec 

e (T  + 273.  15)/288.  15 

Subscripts 

eng  main  engine 

zonel  zone  1 

zone2  zone  2 

0.  5 inlet  cowl  lip  station 

1 inlet  geometric  throat  station 
1. 1 inlet  throat  exit  station 

2 engine  fan  inlet  station 

2.  2 engine  low-pressure  compressor  discharge  station 

3 engine  high-pressure  compressor  discharge  station 

4 engine  high-pressure  turbine  inlet  station 

5 engine  low-pressure  turbine  discharge  station 


APPARATUS  AND  PROCEDURE 

Testing  of  the  digital  integrated  control  was  conducted  in  the  Lewis  10-  by  10-Foot 
Supersonic  Wind  Tunnel.  The  propulsion  system  was  composed  of  a mixed-compression 
inlet  coupled  to  a dual  rotor  turbofan  engine.  Figure  3 shows  the  system  installed  in  10- 
by  10-Foot  Supersonic  Wind  Tunnel.  Table  I lists  the  average  tunnel  free  stream  condi- 
tions. A brief  description  of  the  inlet,  engine,  and  computer  are  provided  in  the  follow- 
ing sections.  Con^lete  descriptions  of  the  inlet,  engine,  and  computer  are  provided  in 
reference  8. 
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Inlet 


The  Lewis  designed  inlet  is  an  axisymmetrlc,  mixed-compression  inlet  with  trans- 
lating centerbody  and  45  percent  internal  supersonic  area  contraction.  The  inlet  is  de- 
signed for  Mach  2.  5 operation  with  a TF30  engine.  The  inlet  has  a capture  area  of 
0.  707  square  meters  and  measures  180  centimeters  from  the  cowl  lip  to  the  fan  face. 
The  inlet  is  equipped  with  eight  slotted  plate  bypass  doors  which  are  used  to  position  the 
inlet  terminal  shock. 


Engine 

The  engine  used  in  this  investigation  is  a Pratt  and  Whitney  TF30-P-3.  The  TF30- 
P-3  is  an  axial,  naixed-flow,  augmented,  twin  spool,  low  bypass  ratio  turbofan  engine 
with  a variable  area  convergent  primary  nozzle.  The  engine  includes  a three-stage 
axial-flow  fan  mounted  on  the  same  shaft  with  a six-stage  axial-flow  low-pressure  com- 
pressor. This  unit  is  driven  by  a three-stage  low-pressure  turbine.  A seven-stage 
axial-flow  compressor  driven  by  a single-stage,  air-cooled  turbine  makes  up  the  high- 
pressure  spool.  The  compressor  is  equipped  with  7th  stage  (low-pressure  compressor) 
and  12th  stage  (high-pressure  compressor)  bleeds.  The  7th  stage  bleed  is  operated  by 
aircraft  systems  and  the  12th  stage  is  normally  operated  automatically  by  the  engine 
control  system.  The  12th  stage  bleed  was  set  closed  for  this  test.  i 

The  augmentor  consists  of  a diffuser  section,  five  concentric  ring  fuel  manifolds 
(zones),  three  V-gutter  ring  flame  holders,  a combustion  chamber  liner,  and  a fully 
modulating  flap-type  convergent  primary  nozzle.  Variable  thrust  augmentation  is  accom- 
plished by  adjusting  fuel  through  the  fuel  manifolds.  Augmentor  ignition  is  by  means  of 
two  ’’slugs”  of  fuel  injected  into  the  engine  gas  stream,  one  upstream  of  each  turbine. 
This  ’’hot  streak”  continues  aft  and  ignites  the  augmentor  fuel.  The  augmentor  zones 
are  turned  on  sequentially,  each  reaching  a predetermined  level  before  proceeding  to  the 
next.  Note  that  only  the  first  two  zones  of  the  augmentor  were  actually  used  for  this  test 
program. 

The  standard  TF30-P-3  fuel  control  systems  consist  of  a hydromechanical  main  fuel 
control  (MFC)  and  a hydro  mechanical  combined  augmentor  and  exhaust  nozzle  control 
(A/B-ENC).  a single  power  level  commands  the  MFC  and  A/B-ENC.  However,  to  pro- 
vide access  to  the  augmentor  at  the  nonstandard  wind  tunnel  conditions,  the  A/B-ENC 
was  completely  removed  from  the  engine  and  replaced  with  servocontrolled  throttles  for 
fuel  flow  control,  a position  servo  for  the  exhaust  nozzle,  and  solenoid  valves  for  gener- 
ation of  the  logic  signals  used  by  the  augmentor  ignitor. 

Integral  with  the  MFC  is  a so-called  ’’Weapons  Derichment  Port”  to  which  for  some 
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engine  installations  an  electrically  operated  valve  is  connected  to  allow  derichment  of 
fuel  during  the  firing  of  aircraft  weapons.  A servocontr oiled  throttling  valve  was  at- 
tached to  this  port  to  allow  the  bypassing  of  fuel.  By  setting  the  power  lever  angle  (PLA) 
to  a high  enough  value,  the  MFC  computer  would  provide  acceleration  fuel  flow.  The  ex- 
cess fuel  could  then  be  bypassed  and  engine  speed  regulation  obtained  externally  of  the 
MFC.  The  hydro  mechanical  control  could  then  be  used  for  startup  as  well  as  emergency 
procedures  during  the  tunnel  operation.  » 


Instrumentation 

Sixteen  steady-state  transducers  were  used  to  measure  the  inlet  terminal  shock  po- 
sition. These  transducers  start  at  a distance  of  23  centimeters  from  the  cowl  lip  and  ex- 
tend to  a point  66  centimeters  from  the  cowl  lip.  The  last  two  transducers  were  located 
5. 08  centimeters  apart  while  the  others  were  located  2.  54  centimeters  apart.  The  dy- 
namic pressures  were  measured  with  strain-gage-type  transducers  connected  to  the  cowl 
with  short  tubes.  The  frequency  response  of  this  pressure  measuring  system  had  negli- 
gible dynamics  in  the  range  covered  in  these  tests  (0. 1 to  100. 0 Hz). 

There  are  four  dynamic  transducers  located  66  centimeters  from  the  cowl  lip  and 
positioned  90°  apart  circumferentially  around  the  cowl.  These  static  pressure  signals 
were  electrically  averaged  and  identified  as  p^  ^ In  addition  to  these  transducers,  dy- 
namic transducers  were  included  to  measure  total  and  static  pressure  at  the  geometric 
throat  and  p^,  respectively),  and  static  pressure  near  the  cowl  lip  Pq  g. 

Ail  engine  pressures  used  engine  supplied  probes;  that  is,  the  pg  signal  comes 
from  the  pressure  signal  tube  going  to  the  MFC.  All  pressure  signals  were  sensed  by 
strain-gage-type  pressure  transducers.  The  fan  inlet  temperature  T2  was  sensed  by  a 
thermocouple,  but  the  high-pressure  turbine  inlet  temperature  T^  is  the  Pratt  and 
Whitney  supplied  signal  which  is  based  on  the  temperature  rise  across  the  compressors 
and  the  low-pressure  turbine  discharge  temperature.  The  low-pressure  rotor  speed  was 
sensed  by  a magnetic  pickup  and  gear  located  in  the  "bullet  nose".  The  high-pressure 
rotor  speed  was  sensed  by  a magnetic  pickup  and  gear  located  on  the  gear  box.  All  fuel 
flows  were  measured  by  turbine  flowmeters.  The  two  speeds  and  the  fuel  flows  were 
converted  to  high  level  analog  signals  for  use  by  the  digital  integrated  control  and  re- 
cording equipment.  The  nozzle  exit  area  and  the  compressor  bleed  positions  were  ob- 
tained from  potentiometers. 
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Digital  Computer 


The  digital  integrated  control  was  in^lemented  on  a digital  computer,  located  at  the 
analog  computer  facility  in  a building  approximately  500  meters  from  the  test  facility. 

It  was  connected  to  the  test  facility  via  land  lines  with  ground  isolation  amplifiers  at  the 
receiving  end  of  each  line.  A small  desk-top-size  10-volt  general  purpose  analog  com- 
puter was  also  used  for  signal  conditioning  and  biasing  of  both  sensed  model  parameters 
and  returned  control  commands.  The  analog  computer  was  located  at  the  test  facility. 
The  digital  system  consists  of  four  major  units. 

(1)  A digital  computer  with  16  384  words  of  memory,  a read-restore  memory  cycle 
of  750  nanoseconds,  and  a word  length  of  16  bits. 

(2)  A digital  interface  capable  of  converting  both  analog  and  frequency  signals  to 
computer  compatible  digital  words  and  converting  computer  generated  words  to  analog 
and  logical  outputs. 

(3)  A signal  processing  unit  which  provides  signal  conditioning  and  monitoring  capa- 
bility between  the  digital  interface  and  the  propulsion  system  to  be  controlled. 

(4)  Programming  peripherals  consisting  of  a high-speed  paper-tape  reader  and 
punch,  and  a teletype. 

The  capabilities  of  the  system  are  given  in  table  II  and  a comprehensive  description  is 
available  in  reference  9. 


Procedure 

The  inlet,  engine,  and  control  system  were  tested  at  zero  angle-of-attack.  No  angle- 
of-attack  data  were  obtained.  At  angle-of-attack  the  inlet  control  requires  more  shock 
position  instrumentation  than  was  provided  in  this  inlet.  The  mass  flow  delivered  to  the 
engine  was  varied  by  adjusting  the  amount  of  airflow  bypassed  by  the  disturbance  doors 
of  the  inlet.  This  would  allow  the  observance  of  the  behavior  of  the  system  to  steady- 
state,  step,  and  sinusoidal  disturbances  in  airflow.  The  inlet  was  unstarted  by  momen- 
tarily reducing  the  inlet  throat  bleed  until  the  throat  Mach  number  dropped  low  enough 
for  the  inlet  to  unstart.  Behavior  of  the  control  to  unstarts  could  then  be  determined. 

For  testing  of  the  augmentor  control,  the  primary  method  of  disturbing  the  control  was 
the  PLA.  Step  changes  in  the  PLA  were  used.  To  get  in  condition  for  these  tests,  the 
engine  would  be  started  with  the  hydro  mechanical  MFC  while  the  inlet  was  controlled 
using  an  electronic  analog  control. 


508 


CONTROL  DESCRIPTION 


The  goals  of  the  integrated  control  are  summarized  as  follows.  By  matching  engine 
airflow  to  available  inlet  airflow,  inlet  pressure  recovery  is  maximized  and  spillage 
airflow  is  minimized,  and  both  these  effects  usually  maximize  inlet  performance.  This 
is  the  primary  goal  of  the  digital  integrated  control  and  is  our  definition  of  an  airflow 
match  between  the  ermine  and  inlet.  The  TF30-P-3  is  a turbofan  engine,  and  the  bypass 
ratio  of  the  fan  varies,  depending  on  conditions,  from  about  one  to  two.  Augmentor 
transients  such  as  zone  lights  and  cutoffs  disturb  the  fan  airflow  directly  and  these  dis- 
turbances propagate  up  into  the  inlet  relatively  unimpeded  when  compared  to  turbojets. 
Therefore,  the  second  goal  of  the  control  is  to  provide  a more  stable  operating  point 
while  attempting  augmentor  transients.  The  last  goal  for  the  control  is  to  provide  auto- 
matic inlet  restart  should  an  unstart  occur. 

A description  of  the  basic  inlet  and  engine  control  systems  is  provided  in  the  next 
section  followed  by  a brief  description  of  the  integration  of  these  controls  to  achieve  the 
aforementioned  goals.  A more  detailed  description  of  the  integrated  control  is  provided 
in  reference  8. 


Basic  Control  Functions 

There  are  three  basic  control  functions  for  this  mixed-compression  inlet  and  aug- 
mented turbofan  propulsion  system.  These  are:  (1)  inlet  terminal  shock  and  restart 
control,  (2)  engine  rotor  speed  regulation  and  fuel  flow  limiting  control,  and  (3)  augmen- 
tor and  exhaust  nozzle  control.  A brief  e?q)lanation  of  each  of  these  control  functions 
follows. 

The  basic  control  problem  of  a mixed-compression  supersonic  inlet  is  that  of  main- 
taining the  terminal  shock  in  the  throat  to  maximize  inlet  pressure  recovery  but  not  al- 
lowing the  inlet  to  unstart  (allowing  the  terminal  shock  to  be  expelled  from  the  inlet).  The 
usual  method  of  control  is  to  manipulate  overboard  bypass  doors  to  bypass  inlet  airflow 
which  in  turn  positions  the  terminal  shock.  By  increasing  bypass  airflow,  the  shock  is 
pulled  downstream  in  the  inlet  throat  and  the  reverse  occurs  if  bypass  airflow  is  de- 
creased. Thus  a control  which  senses  shock  position  is  used  to  drive  the  overboard  by- 
pass doors. 

The  second  part  of  the  inlet  control  is  that  of  starting  the  inlet.  Starting  is  defined 
as  causing  the  externally  located  terminal  shock  to  enter  the  throat  region  of  the  inlet. 
(The  inlet  is  unstarted  when  the  terminal  shock  is  located  forward  of  the  cowl  lip. ) 
Starting  is  accomplished  by  increasing  the  ratio  of  throat  area  to  capture  area  until  the 
throat  goes  supersonic,  and  extending  the  spike  increases  ratio  of  the  throat  area  to  cap- 
ture area  for  this  inlet.  Once  started,  the  spike  returns  to  its  design  position.  The 
started  (or  unstarted)  condition  is  detected  by  the  presence  of  supersonic  (or  subsonic) 
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airflow  at  the  cowl  lip. 

For  the  TF30-P-3,  speed  regulation  is  obtained  normally  by  using  PLA  to  schedule 
a high  rotor  speed  reference  in  the  MFC.  The  speed  reference  and  actual  speed  are 
used  in  a droop  governor  to  provide  a ratio  of  fuel  flow  to  burner  pressure  which,  when 
multiplied  by  burner  pressure,  determines  fuel  flow  to  the  engine.  Speed  regulation  is 
obtained  in  that  manner.  The  MFC  also  limits  maximum  fuel  flow  during  acceleration 
to  avoid  turbine  inlet  overtemperature  and/or  compressor  stall,  and  limits  minimum 
fuel  flow  during  deceleration  to  avoid  combustor  blowout  and/or  compressor  stall.  The 
MFC  also  provides  operating  point  information  (high  rotor  corrected  speed)  to  the 
augmentor /exhaust  nozzle  control,  and  a signal  from  the  augmentor  control  indicating 
that  an  augmentor  blowout  has  occurred.  The  augmentor  blowout  signal  causes  the  MFC 
to  switch  from  the  speed  governor  to  a special  fuel  flow  schedule.  This  fuel  flow  sched- 
xile  reduces  fuel  flow  to  the  engine  to  avoid  overspeeding  the  low  rotor. 

The  augmentor  control  uses  PLA  to  command  a level  of  augmentor  fuel  flow  and  to 
determine  which  zones  should  be  lit.  The  zone  fuel  flow  schedules  are  also  ratios  of  fuel 
flow  to  burner  pressure  schedules  because  burner  pressure  is  used  as  a measure  of  en- 
gine core  airflow.  Thus  changes  in  engine  bypass  ratio  are  taken  into  account  to  bias 
those  augmentor  zones  which  are  in  the  fan  duet  airstream.  The  exhaust  nozzle  is  posi- 
tioned to  drive  the  error  in  the  MFC  determined  fan  operating  point  to  zero.  The  fan 
operating  point  schedule  is  a ratio  of  burner  pressure  to  turbine  discharge  total  pressure 
Pg/Pg  as  a function  of  high  rotor  corrected  speed.  The  rate  of  change  in  Pg  is  used  to 
Indicate  that  the  first  zone  of  the  augmentor  is  lit  or  that  an  augmentor  blowout  occurred. 


Control  Integration 

The  inlet  and  engine  are  defined  as  being  matched  when  the  shock  is  at  the  desired 
location  and  the  bypass  doors  are  closed.  Therefore  a signal  can  be  generated  which 
could  tell  the  engine  to  increase  speed  (and  thus  airflow)  if  more  airflow  is  available  and 
conversely  if  less  airflow  is  available.  It  is  this  type  of  scheme  which  was  developed  to 
satisfy  the  primary  goal  for  the  integrated  control.  The  overall  integration  loops  are 
shown  in  figure  4.  The  nonaugmented  engine  operation  will  be  discussed  first.  The  air- 
flow match  signal  is  defined  as  the  bypass  door  command  signal,  or,  if  the  bypass  door 
command  is  zero,  the  shock  position  error  signal.  This  signal  is  used  to  drive  a pro- 
portional plus  integral  control  which  produces  a shift  in  the  high  rotor  speed  demand  to 
the  engine  speed  governor.  Note,  PLA  normally  generates  the  base  speed  demand  sched- 
ule. 

During  augmentation,  the  exhaust  nozzle  is  also  available  to  adjust  engine  airflow. 
Therefore,  during  augmented  operation,  the  airflow  match  error  signal  biases  the  fan 
operating  point  schedule.  This  is  done  in  such  a manner  as  to  cause  the  exhaust  nozzle 
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to  open  more  than  normal  if  the  bypass  doors  are  open  or  to  close  more  than  normal  If 
shock  is  supercritical.  This  action  was  made  proportional  to  allow  the  integrator  in  the 
speed  demand  shift  logic  to  reset  the  airflow  match  signal  to  zero  by  adjusting  engine 
speed.  This  allows  the  nozzle  to  return  to  its  normal  schedule,  which  is  desirable  since 
significant  changes  in  the  fan  operating  point  can  lead  to  engine  stall. 

The  aforementioned  scheme  will  operate  successfully  except  during  augmentor  tran- 
sients and  inlet  unstart-restart.  Therefore,  additional  logic  signals  were  used  for  these 
special  cases. 

Augmentor  transient  signals  are  generated  by  the  augmentor /exhaust  nozzle  control 
to  tell  the  engine  and  inlet  controls  that  engine  induced  airflow  transients  can  be  expected. 
The  signals  are  simply  logic  signals  that  indicate  whether  or  not  the  augmentation  level 
has  reached  that  commanded  by  PLA.  One  augmentor  transient  signal  sets  the  airflow 
match  signal  to  zero  which  causes  the  speed  demand  control  to  hold  its  present  value 
until  the  transient  is  over. 

Since  the  response  of  the  bypass  door  control  may  not  be  capable  of  handling  the 
augmentor  induced  airflow  transient,  another  augmentor  transient  signal  is  used  by  the 
inlet  control  to  command  the  shock  to  a more  supercritical  location  appropriate  to  the 
expected  airflow  transient.  Because  the  speed  demand  is  held  constant,  the  engine  speed 
will  not  change  and  the  bypass  doors  will  open  to  move  the  shock  to  the  more  supercritical 
location.  Having  both  the  shock  positioned  supercritically  and  the  bypass  doors  partially 
open  is  desirable  when  large  airflow  transients  are  expected  from  the  engine. 

The  augmentor  blowout  signal  causes  the  MFC  to  switch  from  the  speed  governor  to 
a special  fuel  flow  schedule.  Thus,  during  this  time,  the  speed  demand  is  placed  in  the 
hold  mode. 

The  unstart-restart  signal  for  the  engine  is  the  unstart-restart  signal  used  by  the 
inlet  control  except  that,  as  far  as  the  engine  is  concerned,  the  restart  is  not  complete 
until  the  spike  has  returned  to  its  design  point.  The  unstart-restart  signal  causes  the 
value  of  the  shift  in  speed  demand  to  be  reset  to  zero.  The  augmentor /exhaust  nozzle 
control  uses  the  unstart  portion  of  this  signal  to  cause  an  automatic  shutdown  of  the  aug- 
mentor. This  is  based  on  the  assumption  that  the  engine  will  stall  when  the  inlet  unstarts 
and  it  is  felt  that  the  augmentor  should  be  turned  off  with  engine  stalls. 

The  digital  integrated  control  briefly  described  here  and  more  completely  in  refer- 
ence 8 used  no  additional  sensed  inlet  or  engine  variables  than  would  be  used  for  the 
conventional  controls. 
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RESULTS  AND  DISCUSSION 


The  control  described  in  this  report  was  tested  with  three  inlet  configurations.  The 
results  presented  here  are  for  the  inlet  configured  with  10-herta  bandwidth  inlet  over- 
board bypass  doors.  By  10-hertz  bandwidth,  we  mean  that  the  position  servo  frequency 
response  of  the  overboard  bypass  doors  exhibited  a first-order  rolloff  at  approximately 
10  hertz.  Two  other  configurations  were  tested.  These  were  one  with  80-hertz  band- 
width bypass  doors  and  one  with  10-hertz  bandwidth  bypass  doors  and  with  a controlled 
variable  bleed  at  the  Met  throat.  The  results  of  these  latter  two  configurations  may  be 
found  in  reference  8.  In  discussing  the  results  of  the  10-hertz  bandwidth  l^ass  doors, 
the  major  differences  in  the  results  of  the  other  configurations  will  be  mentioned. 

The  digital  control  sampled  the  Met  variables  and  calculated  the  inlet  control  output 
commands  once  every  5 milleseconds.  The  engine  variables  were  sampled  and  the  en- 
gine control  output  commands  calculated  once  every  50  milleseconds.  These  sample 
times  are  representative  of  the  differences  in  the  dynamics  of  the  Met  and  engine.  De- 
tails of  how  the  computer  functioned  with  the  different  time  steps  and  shared  the  same 
multiplexer  are  described  in  reference  8. 

Met  terminal  shock  position  could  not  be  dynamically  measured  directly  in  the  inlet. 
Therefore,  a throat  exit  static  pressure  signal  was  obtained  which  could  be  used  as  a 
dynamic  measure  of  shock  position  for  feedback  to  the  control.  The  relation  of  this  pres- 
sure pj^  ^ to  shock  position  is  shown  in  figure  5, 

Figure  6 shows  the  action  of  the  control  to  a square-wave-type  disturbance  of  inlet 
airflow.  The  magnitude  of  this  disturbance  was  0. 85  percent  peak-to-peak  of  the  engine 
total  corrected  airflow  of  68  kilograms  per  second.  At  the  step  closing  of  the  disturbance 
bypass  doors,  the  control  bypass  doors  step  open  to  eorreet  for  the  error  in  shock  posi- 
tion pj^  Closing  the  disturbance  bypass  doors  increases  the  airflow  available  to  the 
engine.  The  engine  speeds  then  increase  to  allow  the  control  bypass  doors  to  close. 

With  the  control  gains  that  were  used,  this  process  was  underdamped  and  the  speeds 
would  overshoot  momentarily  pulling  the  shock  to  a slightly  supercritical  position.  When 
the  disturbance  bypass  doors  open,  the  available  airflow  to  the  engine  is  reduced.  Thus 
at  the  step  opening  of  the  disturbance  bypass  doors,  the  shock  was  pulled  to  a slightly 
supercritical  position.  Engine  speeds  then  reduce  allowing  the  shock  to  return  to  the 
desired  position.  The  system  is  still  underdamped,  but  less  than  for  the  step  closing  of 
the  disturbance  bypass  door  transient.  The  control  thus  was  able  to  match  engine  airflow 
to  available  inlet  airflow  and  achieve  the  result  of  no  overboard  bypass  airflow  in  steady 
state  while  maintaMng  the  shock  at  the  desired  position.  This  was  the  first  goal  of  the 
Megrated  control. 

The  second  goal  of  the  control  was  to  miniMze  Met  unstarts  durii^  augmentor  tran- 
sients. Figure  7 is  an  augmentor  transient  from  light-off  to  maximum  zone  2.  As  the 
PLA  is  advanced  Mo  augmention,  the  control  commands  the  shock  to  a more  supercriti- 
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cal  position  (lower  in  anticipation  of  the  augmentor  light-off  disturbance.  In  this 

case,  pj^  was  reduced  from  5.  50  to  4. 97  newtons  per  square  centimeter.  This  posi- 
tions the  shock  17.  5 centimeters  downstream  of  the  throat  instead  of  the  3 centimeters 
during  normal  operation.  The  control  bypass  doors  open  to  achieve  this  result.  The  en- 
gine speeds  were  not  allowed  to  reset  the  control  bypass  doors  during  the  augmentor 
transient.  Total  fuel  flow  shows  the  increase  in  fuel  flow  as  the  first  augmentor  zone 
starts  flowing.  The  augmentor  does  not  light-off  right  away  since  the  fuel  is  filling  the 
manifolds.  The  large  jump  in  the  turbine  discharge  pressure  Pg  indicates  that  the  aug- 
mentor has  lit-off  and  the  exhaust  nozzle  is  released.  The  exhaust  nozzle  slews  open  to 
reduce  the  error  in  the  ratio  of  Pg  to  Pg  and  thus  maintains  the  engine  at  the  desired 
operating  condition.  As  the  error  in  P3/P5  is  reduced,  the  augmentor  fuel  flow  is  al- 
lowed to  increase  to  maximum  zone  1.  The  second  step  on  the  total  fuel  flow  trace  is 
the  fuel  flow  for  the  second  zone  turning  on.  After  a manifold  fill  delay,  the  second  zone 
is  allowed  to  increase  to  its  maximum.  After  the  augmentor  has  reached  the  desired 
level  of  operation,  the  shock  command  is  returned  to  its  nominal  value  and  the  bypass 
doors  are  closed  again.  Thus  by  pulling  the  shock  back  to  a more  supercritical  position, 
the  additional  inlet  stability  margin  could  be  obtained  to  avoid  an  inlet  unstart  due  to  an 
augmentor  light-off  transient. 

Figure  8 is  an  augmentor  transient  where  the  augmentor  is  turned  off  from  maximum 
zone  2,  Again  the  shock  is  positioned  to  a more  supercritical  value  during  the  transient. 
As  PLA  is  reduced  out  of  augmentation,  the  control  reduces  the  fuel  flow  first  in  zone  2 
then  zone  1.  The  exhaust  nozzle  area  decreases  to  maintain  the  desired  ratio  of  pg  to 
Pg.  At  the  minimum  fuel  flow  for  zone  1,  the  fuel  flow  is  cut  off  abruptly.  This  is 
shown  in  the  figure  as  the  drop  off  of  fuel  flow.  The  exhaust  nozzle  then  returns  to  its 
nominal  area.  However,  the  shock  is  pulled  to  a more  supercritical  position  while  the 
nozzle  is  closing.  Once  the  nozzle  has  returned,  the  shock  is  returned  to  its  nominal 
position  and  the  control  returns  the  control  bypass  doors  to  their  closed  position.  Again 
the  control  achieves  the  desired  results  of  no  unstarts  during  augmentor  transients  and 
in  steady  state  the  engine  airflow  is  matched  to  the  available  inlet  airflow. 

As  mentioned  earlier,  the  control  was  also  tested  with  80-hertz  bandwidth  bypass 
doors  and  with  10 -hertz  bypass  doors  with  a throat  bleed  control.  The  response  of  the 
80-hertz  bandwidth  bypass  door  control  to  the  square-wave  disturbance  was  essentially 
the  same.  However,  because  of  the  greater  response  capability  of  the  door  servos,  the 
inlet  terminal  shock  control  was  better  able  to  handle  the  augmentor  transient  airflow 
disturbances.  The  net  result  was  that  it  was  not  necessary  to  position  the  shock  to  such 
a supercritical  value.  For  the  80 -hertz  bandwidth  bypass  door  control,  the  value  of  the 
Pj^  command  was  reduced  to  only  5. 40  newtons  per  square  centimeter  instead  of  4. 97. 
liiis  positioned  the  shock  6.  5 centimeters  downstream  of  the  inlet  throat  instead  of 
17.  5 centimeters  as  was  required  for  the  10-hertz  bandwidth  bypass  door  case. 
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The  throat  bleed  for  this  inlet  consisted  of  a slot  just  upstream  of  the  geometric 
throat.  This  slot  duncped  into  a volume  which  was  bled  overboard  through  four  servo 
controlled  butterfly  valves.  This  bleed  was  used  as  a ’’shock  trap”  by  monitoring  the 
inlet  throat  Mach  number  and  opening  the  valves  if  the  throat  Mach  number  dropped  too 
low.  By  including  this  control  with  the  10-hertz  bandwidth  bypass  door  control,  it  was 
also  possible  to  reduce  the  supercritical  value  of  shock  position  during  the  augmentor 
transient.  The  value  of  pj^  ^ command  of  this  control  was  reduced  to  only  5.  35  newtons 
per  square  centimeter.  This  positioned  the  shock  8.  5 centimeters  downstream  of  the 
throat.  During  normal  operation,  the  shock  is  positioned  3 centimeters  downstream  of 
the  throat. 

The  last  goal  of  the  integrated  control  was  to  provide  automatic  inlet  restart  should 
an  inlet  unstart  occur.  Figure  9 shows  an  inlet  unstart  with  tiie  engine  at  the  maximum 
zone  2 condition.  Immediately  following  the  unstart  the  augmentor  control  portion  of  the 
integrated  control  starts  to  close  the  exhaust  nozzle  and  to  shut  off  the  augmentor  fuel 
flows.  The  inlet  control  portion  of  the  integrated  control  starts  extending  the  spike  to 
increase  the  ratio  of  throat  area  to  capture  area  until  the  throat  goes  supersonic  again 
and  the  inlet  restarts.  The  ][  command  is  adjusted  to  maintain  a choked  condition  in 
the  inlet  throat  to  avoid  inlet  buzz.  Just  before  the  inlet  is  restarted  the  Pj  ^ command 
is  reduced  considerably.  The  reason  for  this  is  that  this  inlet  generates  considerable 
distortion  under  restart  conditions  and  this  was  an  attempt  to  avoid  a second  engine  stall. 
A second  engine  stall  occurs  anyway  just  after  the  inlet  restarts.  This  causes  a second 
unstart,  but  the  inlet  again  restarts  without  further  engine  stalls.  This  characteristic  of 
the  second  engine  stall  during  restart  when  unstart  occurred  during  augmented  engine 
operation  is  not  understood  at  this  time.  The  augmentor  is  shut  down  during  the  inlet 
restart  sequence  and  does  not  relight  without  removing  the  PLA  from  augmentation  and 
then  returning  it  to  augmentation.  The  control,  however,  does  bring  the  inlet  and  engine 
back  to  the  match  condition  after  the  spike  has  been  returned  to  its  design  position. 


SUMMARY  OF  RESULTS 

The  general  problems  associated  with  the  mixed-compression  inlet  and  augmented 
turbofan  engine  should  be  similar  to  those  experienced  with  this  particular  combination. 
The  results  of  this  test  program  indicate  that  the  problems  of  control  of  an  augmented 
turbofan  engine  and  mixed-compression  inlet  can  be  minimized  by  integrating  the  engine 
and  inlet  control  systems.  This  integration  required  no  additional  instrumentation  than 
that  normally  required  for  this  combination  of  engine  and  inlet. 

The  digital  integrated  control  demonstrated  an  on-line  digital  control  that  provided 
integration  of  both  augmented  turbofan  engine  and  mixed-compression  supersonic  inlet 
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control  systems.  The  control  matched  engine  mass  flow  to  available  inlet  mass  flow. 

By  monitorir^  inlet  terminal  shock  position  and  overboard  bypass  door  command,  the 
control  adjusted  engine  speed  so  that  in  steady  state,  the  shock  would  be  at  the  desired 
location  and  the  overboard  bypass  doors  would  be  closed.  The  control  thus  obtained 
maximum  mass  flow  recovery  as  well  as  maximum  pressure  recovery  consistent  with 
inlet  stability.  During  engine  induced  transients,  such  as  augmentor  lights  and  cutoff, 
the  inlet  operating  point  was  charged  to  a more  supercritical  point  and  thus  minimized 
unstarts.  The  digital  control  also  provided  automatic  restart  of  the  inlet  should  an  un- 
start occur,  and  provided  automatic  augmentor  operation. 

For  the  system  tested  here,  an  improvement  in  response  and  damping  could  be  ex- 
pected with  further  effort  and  could  also  lead  to  additional  sensed  parameters.  Also, 
some  of  the  areas  not  investigated  for  this  control  system  were  the  effects  of  including  a 
turbine  inlet  temperature  limit,  and  of  a mechanical  limit  on  either  rotor  of  the  engine. 
However,  these  areas  are  details  that  could  be  included  in  the  next  effort  on  applying 
digital  integrated  control  to  the  mixed-compression  inlet  and  augmented  turbofan  engine. 
In  addition,  the  control  tested  in  this  study  matched  engine  airflow  to  available  inlet  air- 
flow while  maximizii]g  inlet  recovery.  Other  approachfes  to  the  integration  might  be  to 
maximize  thrust  specific  fuel  consumption  or  overall  thrust  subject  to  the  appropriate 
restrictions.  It  is  possible  that  these  approaches  would  result  in  a different  match 
between  the  inlet  and  engine  than  in  the  control  described  in  this  report. 

Lewis  Research  Center, 

National  Aeronautics  and  Space  Administration, 

Cleveland,  Ohio,  May  3,  1974 
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TABLE  L - TEST  CONDITIONS 

Mach  number . . , , 2.  5 

2 

Free  stream  total  pressure,  N/cm  . ...  9.  3 

Free  stream  total  ten^)erature,  • 297 

Specific  heat  ratio . 1.  4 

Reynold’s  number  index”  . . 86 

Engine  total  corrected  airflow,  kg/sec.  . . 70.  8 


^Standard  day  free  stream  total  temperature  at 
20  000 -meter  altitude  would  be  488  K. 

^^tio  of  Reynold’s  number  at  station  2 to 
Reynold's  number  at  sea-level  static. 
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TABLE  IL  - DIGITAL  CONTROL  COMPUTER  SYSTEM  CAPABILITIES 


Digital  computer 

Magnetic  core  memory  size,  words  . . ...  . . . . . . . . . 

Word  length,  bits  plus  parity  

Memory  cycle  time,  nsec 

Add  time,  psec  . . .........  . . . . ......... 

Multiply  time,  psec  ...................... 

Divide  time,  psee  , 

Load  time,  psec  ....................... 

Indirect  addressing  ...................... 

Indexing  

Priority  interrupts 

Index  registers  ........................ 

Interval  timers  ........................ 

Analog  acquisition -unit 

Overall  sample  rate  (maximum),  kHz  . . . . . ....  . . ,.  . . 

Resolution  of  digital  data,  bits  

Output  code 

Number  of  channels  . 

Input  range,  V full  scale  

Conversion  time,  psec  

Total  error  with  calibration,  percent  .............. 

Analog  output  imit 

Total  number  of  digital -to -analog  conver  sion  channels  (DAC)  . . . 
Resolution  (13  bit  DAC;  10  channels),  bits 

Accuracy  (13  bit  DAC),  percent  of  full  scale 

Resolution  (12  bit  DAC;  16  channels),  bits.  . 

Accuracy  (12  bit  DAC),  percent  of  full  scale  ........... 

Output  voltage  range,  V full  scale  . 

Slew  rate,  V/psec 

Priority  interrupt  processor 

Number  of  channels  

Input  voltage  range,  V .......  

Computer  switching  

Comparator  hysteresis,  mV  . 

Comparator  output,  V ....  


. . . . . 16  384 

.......  16 

......  750 

......  1.5 

......  4.5 

......  8.25 

1.5 

Infinite 

. . Total  memory 
28  Separate  levels 
.......  2 

.......  2 


......  . 20 

. . 12  (plus  sign) 
Two’s  complement 
.....  . . 64 

.......  ±10 

.......  38 

0.073 


26 

12  (plus  sign) 

. . . . ±0.05 
11  (plus  sign) 

. . . . ±0.1 

±10 

. . . . . 1 


..........  10 

.....  ±10 

. Trigger  on  rise  or  fall 
Adjustable  from  35  to  650 
..........  7 


Figure  1.  - Typical  augmentor  light -off  airflow  distur- 
bance as  seen  at  inlet 


Time,  sec 


Figure  Z - Augmentor  light-off  induced 
inlet  unstart  and  subsequent  inlet  re- 
start and  second  engine  stall. 
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r Low-pressure  compressor 
A exit.  Station  2.  2 
Fan  inlet.  Station  2 \ 


CC-1MZ9-28 

Figure  3.  - Cross  section  of  55-45  axisymmetric  mixed-compression  inlet  and  TF30-P-3  turbofan 
engine. 


Shock  position,  cm  (downstream  of  throat) 


Figure  5.  - Relation  of  throat  exit  static  to 
shock  position. 


522 


Figure  6.  - Square  wave  airflow 
disturbance. 


“1  0 1 2 3 4 5 6 7 

Time,  sec 


Figure?.  - Augmentor  transrent,  light-off  to 
maximum  zone  2. 


Time,  sec 


figures.  - Augmentor transient, 
turn-off  from  maximum  zone  Z 
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Figure  9.  - Inlet  unstart  and  automatic 
restart  with  unstart  occurring  at 
maximum  zone  2 augmentation. 
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SESSION  V 


A FLIGHT  INVESTIGATION  OF  A TERMINAL  AREA  NAVIGATION 
AND  GUIDANCE  CONCEPT  FOR  STOL  AIRCRAFT 


D.  W.  Smith,  F.  Neuman, 

D.  M.  Watson,  and  G.  H.  Hardy 
NASA  Ames  Research  Center 


INTRODUCTION 


Studies  have  shown  (e.g.,  refs.  1 and  2)  that  short-haul  aircraft  may 
provide  an  effective  transportation  system  that  can  operate  into  city  centers 
and  suburban  facilities.  To  provide  the  detailed  data  base  required  for  the 
design  and  development  of  such  a short-haul  system,  a joint  DOT/NASA  STOL 
Operating  Systems  Experiment  Program  has  been  initiated.  As  a part  of  this 
joint  program,  NASA/ Ames  has  developed  an  experiments  program  with  the  overall 
objective  of  providing  information  that  will  aid  in  the  choice  of  terminal 
area  guidance,  navigation,  and  control  system  concepts  for  short-haul  aircraft, 
and  investigating  operational  procedures. 

In  a short-haul  transportation  system,  various  levels  of  avionics  systems 
capability  may  be  needed.  Simple,  low-cost  systems  may  be  adeqixate  for  navi- 
gation, guidance,  and  control  of  aircraft  operating  in  low-density  traffic 
conditions  and  relatively  good  weather.  More  complex  and  costly  automated 
systems  may  be  economically  justifiable  for  operations  in  high-density  traffic 
conditions  and  poor  weather.  The  test  data  obtained  in  this  program  will  pro- 
vide a basis  for  the  selection  of  system  capability  to  meet  operational 
requirements  (e.g.,  runway  requirements,  weather  minimums,  etc.)  and  will  also 
provide  means  for  estimating  the  system  acceptability  and  system  cost. 

A digital  avionics  system  referred  to  as  STOLAND  nas  been  purchased  and 
installed  (without  servos)  in  the  NASA  CV-340  twin-engine  transport  aircraft. 
Nineteen  test  flights  have  been  made  since  October  1973  to  obtain  preliminary 
STOLAND  performance  data  in  the  manual  flight  direetor  mode  using  time- 
controlled  guidance. 

STOLAND  is  also  installed  (with  servos)  in  the  powered-lift  Augmentor 
Wing  Jet  STOL  research  aircraft  (fig.  1)  described  in  reference  3 and  a 
DeHavilland  DHC-6  Twin  Otter  STOL  aircraft.  Investigations  will  soon  be  con- 
ducted in  these  aircraft  to  obtain  performance  data  on  both  simple  and  sophis- 
ticated avionics  system  concepts  and  the  corresponding  STOL  operational 
procedures.  This  report  briefly  describes  the  system  concept  and  presents 
the  more  significant  flight  test  results  obtained  in  the  CV-340  aircraft. 


SYSTEM  CONCEPT  AND  OPERATION 


STOLAND  is  an  integrated  digital  avionics  system  having  a con5)uter  of 
suffieient  size,  speed,  and  capability  to  perform  all  terminal  area  navigation, 
guidance,  and  control  ftinctions,  and  to  automatically  control  and  guide  a STOL 
test  vehicle  along  a curved  reference  approach  flight  path.  Included  in  the 
system  are  the  autopilot  modes  considered  standard  for  commercial  transport 
aircraft  and  an  autothrottle.  This  system  was  built  by  Sperry  Flight  Systems 
to  meet  stringent  performance  and  environmental  requirements.  The  major  com- 
ponents of  the  system  are  a Sperry  1819A  general-purpose  digital  computer  and 
a data  adapter  that  interfaces  all  the  navigation  aids,  displays,  controls, 
and  servo  actuators  (fig*  2).  The  navigation  aids  include  VHF  omnirange  (VOR), 
distance  measuring  equipment  (DME),  tactical  air  navigation  (TACAN)  receiver, 
instrument  landing  system  (ILS),  microwave  modular  instrument  landing  system 
described  in  reference  4 (MODILS),  inertial  navigation  system  (INS),  and  radio 
altimeter. 

The  system  components  installed  in  the  cockpit  of  the  aircraft  (fig.  3) 
include  the  Sperry  RD202A  horizontal  situation  indicator  (HSIj,  control  wheel, 
electronic  attitude  director  indicator  (EADI),  multifunction  display  (MFD), 

MFD  control  panel,  mode  select  panel  (MSP),  status  panel,  and  data  entry  panel. 
During  automatic  operation,  the  pilot  monitors  the  system  operation  through 
the  various  cockpit  displays.  During  flight  director  operation,  the  pilot 
uses  the  same  set  of  displays  for  guidance  information  along  the  reference 
flight  path  and  to  monitor  the  system.  An  illustration  of  the  approach  flight 
path  flown  in  the  CV-340  is  shown  in  figure  4.  It  consists  of  a long  inbound 
leg  (waypoints  1-10),  a 180°  turn  to  final  approach  with  a 5°  glide  slope 
occuring  half  way  around  the  turn  (waypoints  10-12),  and  a final  straight-in 
approach  (waypoints  12-14). 

The  navigation  system  used  for  the  approach  provides  estimates  of  position 
and  velocity  with  respect  to  a runway  coordinate  system,  which  has  its  origin 
at  the  glide-slope  intercept  point  (fig,  4).  The  position  and  velocity  esti- 
mate are  generated  using  ground  navigation  aid  information  blended  in  a com- 
plementary filter  with  inertial  information  obtained  from  body-mounted 
accelerometers  and  attitude  sensors,  and  air  data  obtained  from  a barometric 
altimeter  and  an  airspeed  sensor.  The  ground  navigation  data  are  obtained 
from  TACAN  except  when  the  aircraft  is  in  MODILS  coverage  after  passing 
point  A (fig.  4),  The  navigation  system  also  estimates  wind  velocity  utiliz- 
ing air  data.  In  the  event  of  a momentary  loss  of  ground  radio  navigation 
aid  information^ navigation  is  accomplished  by  dead  reckoning  using  air  data. 
Upon  regaining  radio  information,  the  system  automatically  switches  back  to 
the  use  of  radio  data.  A detailed  description  of  the  navigation  system  is 
presented  in  reference  5. 

The  guidance  system  used  for  the  approach  is  based  on  a flight  path, 
stored  in  the  airborne  computer,  which  is  specified  by  waypoints  (X,Y,Z  coordi- 
nates) and  associated  information  such  as  the  radius  of  turn  between  waypoints 
and  the  maximum,  minimum,  and  nominal  airspeed  between  waypoints.  The  approach 
guidance  is  initiated  when  the  aircraft  captures  the  rear  extension  of  the 
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straight  line  between  waypoints  8 and  9 (see  dotted  line,  fig.  4) . At  waypoint 
8,  controlled  time  of  arrival  (4D)  guidance  is  initiated.  Slightly  before  way- 
point  10,  a predictive  bank  angle  command  is  given,  and  just  before  waypoint 
11,  a constant  vertical  acceleration  maneuver  is  performed  to  acquire  the  5® 
flight-path  angle.  The  short  straight-in  section  (waypoints  12-13)  is  the  last 
segment  using  the  4D  guidance  laws  given  below.  The  remaining  flight  path  to 
flare  is  flown  with  similar  lateral  and  longitudinal  gtiidance  laws  except  for 
the  system  gains,  which  are  relatively  low  from  waypoints  1 to  13,  and  are 
high  from  waypoint  13  to  flare  to  assure  precise  path  tracking. 


For  lateral  tracking  the  guidance  law  is: 


t ^ + KzY  + 

c ^ err  ^ p 


where 

: ' ■ ■■ 

Y cross  track  error 
err 

Y cross  track  velocity 


<l> 

P 

and 


equals  zero,  for  a straight  line  track 


V 2 

4 = tan“^ 

^P  Rg 


for  a circular  track  where 
Vg  ground  speed 

R radius  of  turn 

g acceleration  due  to  gravity 

For  vertical  tracking  the  guidance  law  is: 

K3  K5  f 

0 = rr-  h + K4Y  + Tr~  J h dt 

. c Vg  err  ^ err  Vg  ^ err 

where 


^err  “ ‘^nom  " " flight -path  angle) 


err 


altitude  error 

Yj  equals  > inertial  flight-path  angle  derived  from  the  navigation 
g 

system 

As  previously  stated,  4D  guidance  is  initiated  at  waypoint  8 (fig.  4).  From 
this  point,  the  system  attempts  to  arrive  at  waypoint  13  at  a given  time. 
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Control  of  arrival  time  at  waypoint  13  is  based  only  on  speed  control, 
which  is  provided  by  controlling  the  throttle  as  a function  of  an  airspeed 
error.  In  the  flight  director  mode,  the  airspeed  command  is  displayed  on  the 
EADI.  The  airspeed  command  V^.  is  defined  as  the  algebraic  sum  of  a prescribed 
nominal  airspeed  (Vnom)  an  error  that  is  proportional  to  an  aircraft  posi- 
tion error  (AS): 

V = V - 0.04  AS  Cm/sec) 
c nom  V V V 

where  AS  is  the  distance  along  the  track  from  the  estimated  aircraft  position 
to  a moving  target,  which  represents  the  desired  aircraft  position.  As  the 
aircraft  arrives  at  waypoint  8,  the  target  and  aircraft  positions  are  made  to 
coincide.  The  computed  nominal  arrival  time  at  waypoint  13  is  based  on  the 
time  it  would  take  to  fly  from  waypoint  8 provided  the  aircraft  flew  the  path 
exactly  at  the  nominal  airspeed  and  there  was  no  wind.  To  account  for  winds, 
the  position  of  the  moving  target  is  recomputed  every  10  see  based  on  the  latest 
estimate  of  wind  velocity  and  direction^  This  new  computed  target  position 
assures  that  the  target  will  arrive  at  waypoint  13  at  the  nominal  arrival  time 
while  moving  at  the  nominal  airspeed.  If  the  wind  were  changing  during  the 
approach,  the  confuted  positions  of  the  target  would  have  step  changes  every 
10  sec  which  would  result  in  excessive  throttle  activity.  To  limit  the  throttle 
activity,  the  time  rate  of  change  in  the  value  of  AS  in  the  above  equation  is 
limited  to  6,1  m/sec. 


RESULTS  And  discussion 


As  previously  noted,  the  primary  purpose  of  flight  tests  in  the  CV-340 
was  to  validate  the  operation  of  the  STOLAND  system  and  to  obtain  a preliminary 
insight  into  the  navigation  and  guidance  system  performance.  The  data  pre- 
sented are  from  a set  of  20  simulated  IFR  (hooded)  approaches  conducted  during 
the  latter  stages  of  the  tests. 

For  the  CV-340  flights,  aircraft  position  data  were  provided  by  a 
modified  NIKE-HERCULES  tracking  radar.  These  tracking  data  were  smoothed  with 
a minimum  mean-square  filter  to  obtain  a best  estimate  of  the  actual  aircraft 
position. 

The  data  presented  in  this  report  are  referenced  to  a coordinate  system 
whose  origin  is  at  the  MODILS  glide-slope  intercept  point  (GSIP)  on  runway  35 
at  Crows  Landing  NALF  (see  fig.  4) . The  XY  plane  is  tangent  to  the  earth  at 
the  origin;  the  X axis  is  positive  in  the  direction  of  landing,  the  Y axis 
is  positive  to  the  right,  and  the  H (altitude)  axis  is  positive  up.  Repre- 
sentative performance  of  the  guidance  and  navigation  systems  along  a typical 
approach  is  discussed,  as  well  as  summary  data  for  all  approaches. 


Performance  for  a Typical  Approach 

The  reference  flight  path  and  an  example  of  a typical  approach  are  shown 
in  figure  5.  The  top  half  of  the  figure  shows  the  reference  path  and  the 
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downrange-crossrange  (X  vs  Y)  plot  of  aircraft  position,  and  the  lower  part 
shows  the  corresponding  altitude-downrange  (H  vs  X)  plot.  The  waypoints  are 
shown  for  reference.  The  sum  of  the  system  errors  is  represented  by  the 
lateral  and  vertical  deviations  from  the  reference  path. 

As  shown  in  figure  5 the  approach  was  initiated  at  about  520  m altitude, 
about  280  m to  the  right,  and  30  m above  the  reference  path.  During  the  turn 
to  final  approach,  the  aircraft  remained  to  the  right  of  the  path  and  then 
acquired  the  runway  centerline,  maintaining  that  course  for  the  remainder  of 
the  approach.  The  aircraft  remained  about  10  to  30  ra  above  the  reference  path 
during  the  whole  approach.  The  major  error  prior  to  MODILS  acquisition  can  be 
attributed  to  the  effect  of  a TACAN  DME  bias.  The  errors  attributable  to  the 
navigation  and  the  guidance  systems  are  discussed  below. 

Navigation-  Figure  6 presents  the  lateral  (cross  track)  and  vertical 
navigation  errors  for  the  approach  shown  in  figure  5,  and  the  envelope  of 
errors  experienced  in  the  20  simulated  IFR  approaches.  The  error  presented  is 
the  difference  between  the  onboard  estimate  of  the  aircraft  position  and  the 
tracking  radar  measured  position.  The  error  shown  in  these  traces  is  the 
combined  effect  of  errors  due  to  ground  navaid  and  airborne  receiver  signal 
errors,  off-nominal  atmosphere  effects,  small  errors  in  the  ground  radar  track- 
ing data,  and  the  basic  navigation  system  errors  resulting  from  software/hard- 
ware mechanization.  The  waypoints  are  labeled  for  cross  reference  with 
figure  5. 

The  envelope  of  lateral  navigation  errors  at  initiation  of  the  approach 
at  waypoint  8 are  as  large  as  200  m.  These  errors  converge  to  a maximum  less 
than  70  m at  the  initiation  of  the  turn  at  waypoint  10,  where  they  start  to 
increase  again  to  values  as  large  as  150  m.  Examination  of  the  data  indicate 
that  these  navigation  errors  result  from  TACAN  errors  in  both  range  and  azi- 
muth. A short  time  after  passing  waypoint  10,  a transition  from  TACAN  to 
MODILS  navigation  is  initiated.  Navigation  errors  then  converge  smoothly  to 
less  than  15  m after  transition  to  MODILS  is  completed. 

The  envelope  of  the  time  history  of  the  vertical  navigation  error  shows 
errors  as  large  as  24  m at  initiation  of  the  approach  at  waypoint  8.  The 
vertical  navigation  errors  are  always  positive  and  are  probably  a result  of  a 
bias  in  the  baro-altimeter . It  should  be  noted  that  the  baro-altimeter  refer- 
ence was  set  prior  to  each  approach  based  on  information  radioed  from  the  con- 
trol tower,  which  gives  a correct  barometric  altitude  at  the  runway  level  only. 
After  transition  to  MODILS  and  the  start  of  the  descent  at  waypoint  11,  the 
baro-altimeter  measurement  is  slowly  blended  with  and  replaced  by  the 
more  accurate  MODILS  data  to  prevent  a step  change  in  estimated  altitude  at  the 
initiation  of  glide-slope  tracking.  The  vertical  navigation  error  converges 
to  a constant  value  of  approximately  5 m.  This  bias  is  unexplained  at  this 
time,  although  it  is  speculated  that  several  error  sources  could  be  the  cause. 
For  example,  a MODILS  DME  error  of  about  60  m could  result  in  the  5-m  error. 

It  is  clear  that  more  accurate  navigation  is  required  for  final  flare  - e.g., 
a radio  altimeter  or  a second,  more  accurate  elevation  scanner. 

Guidance-  Figure  7 presents  the  lateral  and  vertical  guidance  errors  for 
the  approach  shown  in  figure  5 and  the  envelope  of  errors  experienced  in  the 
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20  simulated  IFR  approaches.  The  error  shown  is  the  difference  between  the 
onboard  estimate  of  position  and  the  reference  flight  path.  The  waypoints  are 
labeled  for  cross  reference  with  figure  5.  The  envelope  of  time  histories  of 
the  lateral  guidance  error  shows  errors  as  large  as  400  m at  the  initiation  of 
the  approach  at  waypoint  8;  prior  to  switching  to  MODILS,  these  errors  con- 
verge to  smaller  values.  On  switching  to  MODILS  from  TACAN,  the  lateral  navi- 
gation error  decreases  while  the  lateral  guidance  error  increases,  reaching  a 
maximum  at  about  waypoint  11.  This  increase  in  the  lateral  guidance  error 
results  from  a TACAN  range  bias  error  that  causes  the  aircraft  to  fly  on  the 
right  of  the  reference  path  from  waypoint  8 to  point  A (see  fig.  5).  Upon 
switching  to  MODILS,  which  is  a more  accurate  navigation  aid,  the  navigation 
estimate  indicates  that  the  aircraft  is  flying  to  the  right  of  the  reference 
path,  thereby  generating  a lateral  guidance  error  while  the  navigation  error 
converges  to  a small  value.  As  a result  of  the  low  gain  of  the  guidance  sys- 
tem, the  aircraft  is  guided  slowly  to  the  reference  path.  After  passing  way- 
point  11,  the  lateral  navigation  and  guidance  errors  converge  to  small  values. 
As  shown  in  figure  7,  the  envelope  of  the  lateral  guidance  error  converges  to 
about  ±20  m between  waypoints  13  and  14  (i.e.,  1600  m from  touchdown).  The 
envelope  of  vertical  guidance  error  shows  errors  as  large  as  15  m at  the  initi- 
ation of  the  approach  at  waypoint  8 and  is  generally  above  the  desired  path. 

The  magnitude  of  the  error  represented  by  the  envelope  remains  approximately 
constant  between  waypoints  8 and  10.  As  shown  by  the  solid  line  in  figure  7, 
transients  occur  in  the  vertical  guidance  error  when  the  navigation  switches 
from  TACAN  to  MODILS  and  at  approximately  waypoint  11  when  the  descent  is 
initiated.  The  switching  transient  decays  and  the  vertical  guidance  error 
envelope  converges  to  about  ±3  m between  waypoints  13  and  14  as  a result  of 
the  high-gain  guidance  law  and  high-gain  navigation  filters  used  during  the 
final  straight -in  approach. 


Summary  Performance  Data; 

Errors  Prior  to  Flare  (h  ~ 30.5  m) 

Navigation-  Figure  8 shows  the  difference  between  the  aircraft  position 
as  measured  by  ground  radar  and  the  onboard  position  estimate  as  the  aircraft 
passed  through  a window  positioned  at  a nominal  altitude  of  30.5  m on  a 5°  glide 
slope.  (The  symbols  represent  data  obtained  from  flights  on  two  different 
days.)  The  data  show  that  the  aircraft  was  to  the  left  of  the  runway  center- 
line  and  above  the  glide  slope  for  the  majority  of  the  approaches.  For  these 
data,  the  vertical  mean  error  is  2,4  m above  the  reference  glide  slope  with  a 
lateral  mean  error  of  1.9  m to  the  left  of  centerline.  The  2a  errors  about 
the  mean  are  ±2.6  m in  altitude  and  ±4.2  m in  the  lateral  direction. 

Guidance-  Guidance  errors  measured  at  an  altitude  of  30.5  m are  presented 
in  figure  9.  The  reference  in  this  case  is  the  MODILS  5°  glide  slope  as  com- 
puted by  the  navigation  equations.  If  the  guidance  errors  were  zero,  the  data 
points  would  be  clustered  on  the  estimated  glide-slope  centerline  which  is  the 
origin  of  the  graph.  For  these  data,  the  vertical  mean  error  is  0.8  m below 
the  glide  slope  with  a lateral  mean  error  of  0.8  m to  the  left  of  centerline. 

The  2a  vertical  and  lateral  errors  about  the  mean  are  ±2.2  m and  ±6.8  m, 
respectively. 
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Comparison  jtf  Flight  Data  with  CTOL  Requirements 

The  test  flight  data  were  con^jared  with  FAA  Category  II  fljight  director 
certification  criteria  for  CTOL  aircraft  to  determine  whether  ;£he  navigation 
system  under  investigation  might  be  feasible  for  a flight  director  landing  on 
a STOL  runway  in  marginal  weather.  The  FAA  criteria  are  included  in  figute  9. 
The  FAA  criteria  from  AC  120-29  state  that  on  the  localizer, 

"From  an  altitude  300  feet  above  runway  elevation  on  the  approach  path 
to  the  decision  altitude  (100  feet),  the  flight  director  should  cause 
the  airplane  to  track  to  within  ±25  microamperes  (95-percent  probabii- 
ity)  of  the  indicated  course.  The  performance  should  be  free  of  sus- 
tained oscillations." 

and  on  the  glide  slope, 

"From  700  feet  altitude  to  the  decision  altitude  (100  feet),  the  flight 
director  should  cause  the  airplane  to  track  the  center  of  the  indicated 
glide  slope  to  within  ±75  microamperes  or  ±12  feet,  whichever  is  the' 
larger,  without  sustained  oscillations." 

Based  on  a conventional  CTOL  runway  arrangement,  these  criteria  would 
translate  into  allowable  deviations  of  about  ±3.7  m (12  ft)  vertical  and  ±21  m 
(69  ft)  laterally  for  a CTOL  aircraft  at  a longitudinal  location  defined  by  the 
30.5-m  (100-ft)  altitude  point  on  a 2.7"  glide  slope. 

Figure  9 indicates  that  the  2a  errors  measured  in  the  test  flights  are 
within  those  prescribed  for  CTOL  Category  II  system  landing  minima  (shaded  in 
fig.  9).  Additional  testing  is  needed  to  define  the  performance  criteria  for 
STOL  aircraft  certification  for  Category  II  weather  minima.  This  comparison 
of  the  test  flight  data  with  the  FAA  criteria  is  not  entirely  valid,  because 
the  landing  system,  the  wind  environment,  the  glide  slope,  and  other  parameters 
were  different  from  those  outlined  in  the  FAA  advisory  circular.  Nevertheless, 
it  gives  some  measure  of  the  system  performance. 


Speed  Control  and  Longitudinal  Guidance 

Figure  10  presents  the  longitudinal  guidance  error  (AS) , the  Commanded 
airspeed,  the  true  airspeed,  and  the  ground  speed  for  the  approach  shown  in 
figure  5.  Also  shown  are  the  nominal  airspeed  specified  for  the  reference  path 
(fig.  5)  and  the  boundaries  of  the  allowable  airspeed  commands,  designated  by 
the  unshaded  area,  which  are  based  on  the  aircraft  performance  capabilities. 

A comparison  of  the  ground  speed  and  true  airspeed  in  figure  10  indicates  the 
strong  headwind  conditions  experienced  by  the  aircraft  on  the  flight  path 
between  waypoints  8 and  10.  Itader  such  conditions,  the  aircraft  should  fly  at 
an  airspeed  above  the  nominal  to  meet  the  specified  arrival  time.  As  shown, 
the  longitudinal  error,  AS,  increased  linearly  and  the  airspeed  command 
increased  above  the  nominal  airspeed  for  the  first  3000  m of  track  distance. 
From  waypoints  10  to  11,  AS  decreased  linearly  at  its  rate  limit,  as  the  air- 
craft caught  up  with  the  target  and  the  commanded  airspeed  approached  the 
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nominal.  In  this  approach  a longitudinal  error,  AS,  of  76  m,  which  is 
equivalent  to  a 1. 3-sec  time  error,  remained  to  be  corrected  at  waypoint  13. 


Time -of -Arrival  Errors  at  Waypoint  13 

Figure  11  is  a histogram  of  the  time  of  arrival  errors  at  waypoint  13  for 
the  simulated  instrument  (hooded)  approaches.  For  these  tests,  the  mean  time- 
of-arrival  error  is  3.7  sec  (late)  with  2a  deviation  of  ±3.4  see.  The  mean 
time-of-arrival  error  obtained  during  these  tests  may  result  from  the  TACAN 
range  error  which  caused  the  actual  longitudinal  distance  flown  to  be  longer 
than  the  reference  path.  Additional  data  are  required  to  establish  the  system 
performance  for  all  TACAN  errors. 

It  is  interesting  to  note  that  current  manual  guidance  techniques  enable 
air  traffic  controllers  to  deliver  CTOL  aircraft  to  the  runway  within  about 
±15  sec  of  the  predicted  arrival  time  (ref.  6).  This  capability  corresponds 
to  a single  runway  acceptance  rate  of  about  40  IFR  arrivals  per  hour  using  cur- 
rent separation  standards.  Using  the  improved  capability  of  the  automatic 
time  of  arrival  guidance  system  described  here  it  would  be  possible  to 
increase  the  runway  acceptance  rate  by  about  40  percent  (see  ref,  6) . 


CONCLUSIONS 


Results  are  presented  for  20  flight  director  approaches  made  during  an 
investigation  of  a STOL  approach  and  landing  concept  using  the  NASA  CV-340  air- 
craft. Results  of  these  limited  tests  led  to  the  following  conclusions: 

1.  Blended  radio/inertial  navigation  using  TACAN  and  a microwave  scanning 
beam  landing  guidance  system  (MODILS)  permitted  a smooth  transition  from  area 
navigation  (TACAN)  to  precision  terminal  navigation  (MODILS) . 

2.  Guidance  system  (flight  director)  performance  measured  at  an  altitude 
of  30.5  m was  within  that  prescribed  in  FAA  AC  120-29  for  Category  II  CTOL 
operations  on  a standard  runway, 

3.  Time  of  arrival*  at  a point  about  2 mi  from  touchdown  was  about  4 sec 
±3  sec  (2a)  later  than  the  computed  nominal  arrival  time. 
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Figure  1.-  Augmentor  wing  jet  STOL  research  aircraft 


Figure  2.-  STOLAND  flight-test  system 
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Figure  5.-  Typical  flight  path. 
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Figure  6.-  Navigation  errors. 
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Figure  7.-  Guidance  errors. 
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Figure  8.-  Navigation  errors  at  30.5  m. 
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Figure  9.-  Guidance  errors  at  30.5  m. 
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Figure  10.-  Longitudinal  guidance. 
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SOME  SYSTEM  CONSIDERATIONS  IN  CONFIGURING 
A DIGITAL  FLIGHT  CONTROL  - NAVIGATION  SYSTEM 


J.  H.  Boone  and  G.  R.  Flynn 
Boeing  Commercial  Airplane  Company 


SUMMARY 


A trade  study  has  been  conducted  with  the  objective  of  providing  a technical 
guideline  for  selection  of  the  most  appropriate  computer  technology  for  the  Auto- 
matic Flight  Control  System  of  a civil  subsonic  jet  transport. 

The  trade  study  considers  aspects  of  using  either  an  analog,  incremental  type 
special  purpose  computer  or  a general  purpose  computer  to  perform  critical  autopilot 
computation  functions.  It  also  considers  aspects  of’ integration  of  non-critical 
autopilot  and  autothrottle  modes  into  the  computer  performing  the  critical  autoland 
functions,  as  compared  to  the  federation  of  the  non-critical  modes  into  either  a 
separate  computer  or  with  a R-Nav  computer. 

The  study  is  accomplished  by  establishing  the  relative  advantages  and/or  risks 
associated  with  each  of  the  computer  configurations. 


INTRODUCTION 


To  justify  an  investigation  of  the  impact  of  introducing  a new  technology  into 
an  existing  commercial  field,  two  considerations  must  be  ascertained: 

1.  The  motivation  behind  seeking  new  technology,  and 

2.  The  real  advantages  to  be  gained  by  introducing  a particular 
technology. 

Automatic  Flight  Control  systems  of  civil  jet  transports  have  reached  the  stage 
of  seeking  a newer  electronic  technology.  Digital  control  systems  are  the  candidates. 

The  purpose  of  this  paper  is  to  describe  a method  of  conducting  the  background 
trade  studies  to  define  the  risks  and  advantages  of  a technological  change.  Although 
the  application  of  the  method  is  illustrated  in  terms  of  civil  aircraft,  the 
principles  are  basic  and  are  applicable  in  many  different  areas  of  industry. 
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MOTIVATIONS 


The  analog  automatic  flight  control  systems  Installed  on  civil  jet  transports 
represent  significant  contribution  to  the  overall  cost  of  development  to  the  airframe 
manufacturer.  In  the  most  recent  aircraft,  the  wide  bodied  Jumbo  jets,  the  automatic 
flight  control  systems  (AFCS)  accounted  for  development  and  certification  monies 
ranging  from  $10,000,000  to  $30,000,000  (1969  to  1970  dollars).  On  the  average,  the 
production  costs  of  the  wide-bodied  jets'  AFCS  are  $300,000. 

Cost  of  ownership  has  also  become  substantial,  considering  that  airlines  mainten- 
ance figures  show  an  annual  maintenance  cost  of  1.5i/$100  of  initial  system  cost. 

That  amounts  to  $4500  annually,  or  $90,000  over  the  normal  life  span  of  the  aircraft. 

In  general,  such  high  costs  have  been  Incurred  because  of  Increased  performance 
and  safety  requirements.  A particular  point  Is  the  general  requirement  for  automatic 
landing  systems,  resulting  In  Increased  redundancy  In  the  sensors,  computers,  and 
actuators  of  the  AFCS. 

Technological  advances  In  the  analog  art.  In  terms  of  computer  architecture  and 
electronic  component  packaging,  have  managed  to  keep  costs  under  reasonable  control. 

For  example,  considering  only  the  AFCS  electronics,  a dual-pitch  simplex  monitored 
roll  configuration  of  1966  vintage  costs  the  same  as  a total  duplex  pitch-roll  system 
developed  In  1969.  This  Is  in  spite  of  the  fact  that  the  latter  system  has  approx- 
imately 40%  greater  capability  due  to  redundancy  and  Increased  operational  requirements. 

However,  the  situation  doesn't  appear  to  be  stable.  That  is,  advancement  of 
analog  state-of-the-art  isn't  sufficient  to  maintain  an  adequate  margin  against 
further  total  cost  Increase  for  future  airplanes.  One  possible  solution  is  to  change 
the  system  technology  from  analog  to  digital  to  provide  a more  competitive  condition 
In  meeting  yet  higher  performance  and  safety  requirements. 

Substantial  investigation  and  development  has  been  conducted  with  digital  flight 
control  systems  (DFCS).  However,  the  accumulated  data  and  conclusions  are  not 
directly  transferable  to  civil  transports  because  the  greatest  majority  of  the  programs 
have  been  militarily  oriented.  The  result  is  that  the  basic  ground  rules  of  develop- 
ment rely  on  calculated  risk  levels  for  safety,  performance,  and  costs  which  could  not 
be  justified  for  commercial  aircraft. 

Therefore,  any  attempt  to  realistically  judge  the  attendent  risks  and  advantages 
of  developing  a commercial  DFCS  stumbles  over  the  absence  of  hard  trade  data. 

"Absolute"  data  Is  available  for  analog  systems  because  of  comprehensive,  empirical 
do's  - dont's  derived  from  past  experience.  Such  data  are  not  available  for  commercially 
feasible  DFCS. 

A reasonable  comparison  - or  trade  study  - methodology  can  be  developed  in  the 
absence  of  "absolute"  data  by  establishing  a relative  comparison  referenced  to  a known 
quantity.  In  the  present  case,  the  known  quantity  Is  represented  by  an  analog  AFCS 
design  In  which  there  is  a high  level  of  confidence  that  It  will  comply  with  a sig- 
nificant requirement;  the  high  levdl  of  confidence  resulting  from  the  absolute  data 
embodied  in  established  design  techniques  and  practical  experience. 
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The  reference  system  can  then  be  arranged  In  terms  of  known  risk  parameters.  A 
comparison  of  each  risk  parameter,  individually  with  a counterpart  parameter  of  a 
DFCS,  can  be  conducted  in  a relative  sense  to  determine  the  increment  of  risk  incurred 
with  the  DFCS  (a  negative  increment  spotlights  an  advantage).  In  effect,  a sort  of 
chain  rule  is  established  which  allows  evaluation  of  the  newer  technology  system  in 
known  and  understood  terms  of  the  older  technology  system. 


IDENTIFICATION  OF  REAL  ADVANTAGES 


In  order  to  arrange  and  select  appropriate  risk  parameters,  it  is  necessary  to 
identify  the  risk  points  of  the  analog  AFCS.  A general  survey  of  latest  generation 
analog  systems  will  result  in  the  following  conclusions: 

1 . Computational  Accuracy 

Operational  amplifier  techniques  have  reduced  computational  tolerances  to 
levels  between  2 and  5%.  However,  considering  the  total  AFCS  - i.e. , sensors, 
guidance  signals,  actuators,  as  well  as  the  computers  - further  reduction  of 
computational  tolerances  loses  significance  in  view  of  the  tolerances  and 
inaccuracies  of  the  sensors,  guidance  signals,  etc.,  which  typically  range 
between  8 and  20%, 


2.  Reliability 


Design  and  packaging  techniques  have  resulted  in  analog  AFCS  computers 
with  mean  time  between  failures  of  thousands  of  hours.  Manufacturer 
warranties  of  3000-4000  hours  are  not  uncommon.  However,  with  system-wide 
MTBF's  of  200-300  hours,  it  can  be  seen  that  the  computers'  contribution  to 
system  railure  rates  is  relatively  insignificant.  Therefore,  substantial 
design  activity  to  further  increase  computer  reliability  will  not  pay  off 
proportionately  in  overall  system  reliability. 

Another  aspect  of  system  relaibiltty  is  its  availability  - a direct 
function  of  the  system  owner's  ability  to  maintain  the  system.  In  this 
respect,  analog  systems  have  been  shown  by  experience  to’  be  deficient. 

Build-in-test-equipment  (BITE)  is  generally  provided  in  all  modern  analog 
equipment.  However,  each  test  feature,  being  itself  analog,  requires  add- 
itional circuitry  dedicated  to  testing  only.  The  increased  complexity 
generated  by  BITE  motivates  the  designer  to  restrict  BITE  to  within  the 
individual  computer.  System-wide  tests  are  prohibitive. 


The  end  result  is  that  fault  isolation  - to  indicate  appropriate  main- 
tenance activity  - within  the  computer  is  relatively  efficient  (about  86% 
in  the  747).  But  the  "system  effectiveness",  defined  as 


CONFIRMED  FAILURES  1 


X 100%, 


ranges  between  20  and  50%.  Thus,  more  than  half  the  owners  maintenance 
actvities  are  inappropriate. 
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3.  Redundancy  Requirements 

Within  the  scope  of  commercial  jet  transports,  existing  and  imminent, 
redundant  systems  have  relatively  little  application  outside  of  yaw  damping 
(simple  stability  augmentation)  and  automatic  landing.  More  exotic  require 
ments  - flight  critical  modal  suppression  or  control  configured  vehicles 
stability  systems  - are  anticipated  to  be  well  beyond  the  next  generation 
of  civil  aircraft. 

Consequently,  analog  technology  has  been  successfully  applied  to 
existing  redundancy  requirements  since  1966. 

4.  General  Cost  Considerations 

Each  new  generation  of  aircraft  is  accompanied  by  a redesign  of  the 
analog  AFCS.  Invariably  the  redesign  is  necessary  to  incorporate  newer 
packaging  techniques  to  maintain  reliability  and  reduce  costs.  In  effect, 
the  AFCS  is  tailor-made. 

Peripheral  costs  are  induced  by  the  tailoring.  Test  equipment,  tech- 
nician training,  etc.,  must  be  revised  each  time  an  airline  re-equips. 


The  general  conclusions  are  that  an  effective  comparison  between  a digital  and 
analog  AFCS  must  be  parameterized  to  show  substantial  advantages  in  terms  of  system 
maintainability  and  costs.  Structuring  the  trade  to  prove  that  a digital  system  is 
as  good  as  an  analog  system,  or  to  high-light  relatively  insignificant  advantages 
will  not  provide  the  supporting  data  necessary  to  introduce  digital  technology  into 
commercial  AFCS  service. 

Therefore,  selection  of  risk  parameters  associated  with  maintainability  on  a 
systems  basis,  and  cost  reduction  (particularly  through  reasonable  integration  of 
system  functions)  will  provide  the  most  effective  trade  study. 


PRELIMINARY  SELECTION  OF  CANDIDATE  SYSTEMS 


Systems  can  be  examined  under  two  aspects,  viz,  1)  organization,  2)  level  of 
redundancy.  These  factors  interact  to  some  extent,  but  generally  speaking,  system 
organization  is  the  more  fundamental  factor.  Accordingly,  candidate  systems  are 
initially  selected  by  consideration  of  alternate  system  organizations. 

A variety  of  system  organizations  are  available  once  the  decision  to  employ 
digital  technology  has  been  made.  Potential  candidate  systems  range  between  the 
extremes  of  a central  computer  that  performs  all  electronic  computation,  (total  inte 
gration)  to  a one-for-one  replacement  of  analog  LRU's  (Line  Replaceable  Units)  with 
digital  LRU's.  The  number  of  potential  system  candidates  must  be  reduced  to  make 
detailed  trade  studies  between  alternate  systems  feasible. 
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The  extremes,  or  limiting  cases,  in  the  type  of  system  organization  may  be 
disposed  of  by  general  considerations.  For  example,  the  one-for-one  replacement 
of  analog  computing  LRU's  by  digital  elements  obviously  negates  the  advantage  of 
time  shared  digital  computing  elements  in  addition  to  proliferating  I/O  require- 
ments. Plainly,  it  offers  no  advantages  in  the  present  application.  Indeed,  to  the 
authors'  knowledge,  it  has  never  seriously  been  proposed  as  a viable  digital  flight 
control  system  and  it  is  mentioned  and  disposed  of  here  for  the  sake  of  logical 
completeness. 

The  other  limiting  case  - total  integration,  wherein  a number  of  disparate 
computations  such  as  air  data,  navigation,  cruise  autopilot,  etc.,  are  performed 
in  one  computer  - has  been  seriously  proposed  for  a number  of  applications.  From 
certain  aspects  this  is  an  attractive  candidate.  Specifically,  such  a system  organ- 
ization yields  the  minimum  number  of  LRU's,  minimizes  interface  complexity  and 
simplifies  system  test.  Nevertheless,  this  arrangement  must  also  be  rejected  as 
inappropriate  for  the  application  under  study. 

The  rejection  is  based  on  a consideration  of  the  significance  of  various 
computations  that  would  be  performed  in  a central  computer.  Some  of  these  com- 
putations are  dispatch  critical;  i.e.,  the  computations  must  be  available  if  the 
airplane  is  to  be  dispatched.  Air  data  computations  are  an  example  of  computations 
that  fall  in  this  category.  Other  computations,  such  as  cruise  autopilot  modes  or 
autoland  are  not  necessary  for  dispatch.  It  is  highly  desirable  from  an  airline 
point  of  view,  that  a "deferred  maintenance"  policy  be  employed  to  the  extent  poss- 
ible. That  is,  airlines  desire  to  be  able  to  defer  maintenance  action  until  such 
action  is  convenient  from  the  standpoint  of  airplane  schedule  or  location.  The 
integration  of  dispatch  critical  and  nondispatch  critical  functions  in  a common 
computer  is  not  compatible  with  a deferred  maintenance  policy.  Furthermore,  reli- 
ability of  the  dispatch  critical  computations  will  suffer  from  piece  part  consid- 
erations alone.  It  should  be  noted  that  for  some  applications,  such  as  an  RPV, 
where  all  computations  are  required  for  mission  success,  total  integration  might  be 
the  logical  choice  for  system  organization. 

There  still  remains  a large  number  of  potential  candidate  systems  even  after 
the  limiting  cases  have  been  rejected.  The  rationale  for  further  reduction  to 
several  candidates  most  promising  for  detailed  trade  studies  is  based  on  classifying 
the  functions  and  assessing  the  redundancy  requirements.  These  are  shown  in  Table  1. 

Examination  of  Table  1 reveals  that  there  are  only  two  functions  that  are  class- 
ified as  flight  critical;  Category  III  Autoland  and  Yaw  Damping.  Both  of  these 
functions  are  accordingly  assigned  a fail -operational  redundancy  requirement.  There 
is  a significant  difference  in  these  two  computations  however,  since  the  yaw  damping 
function  is  assumed  necessary  for  high  altitude  and  high  Mach  number  flight  (normal 
cruise  envelope).  Therefore,  an  operational  yaw  damper  is  required  for  unrestricted 
dispatch.  The  redundancy  requirement  for  this  function  results  from  the  requirement 
to  maintain  artificial  yaw  damping  until  a speed-altitude  reduction  can  be  effected. 

In  contrast,  the  autoland  function  is  flight  critical  only  during  those  times 
that  Category  III  conditions  prevail;  in  addition,  this  function  is  not  required  for 
dispatch.  The  economic  penalty  for  the  nonavailability  of  the  yaw  damping  function 
is  consequently  much  more  severe  than  the  penalty  for  the  nonavailability  of  Category 
III  autoland. 
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TABLE  1 


FUNCTION 

CLASSIFICATION 

REDUNDANCY 

REQUIREMENT 

CATEGORY  III 
AUTOLAND 

FLIGHT  CRITICAL 

FAIL  OPERATIONAL 

AUTOTHROTTLE 

NON-CRITICAL 

NONE 

CRUISE  AUTOPILOT 
MODES 

NON-CRITICAL 

NONE 

YAW  DAMPER 

FLIGHT  CRITICAL  AT  HIGH 
MACH  & ALTITUDE;  REQUIRED 
FOR  UNRESTRICTED  DISPATCH 

FAIL  OPERATIONAL 

NAVIGATION 

NON-CRITICAL^ 

NONE 

FLIGHT  DIRECTOR 

NON-CRITICAL 

NONE 

The  remaining  functions  are  seen  to  be  classified  as  non-critical  and  similar  in 
redundancy  requirements.  A logical  candidate  for  further  study  is  consequently 
obtained  by  structuring  the  system  on  the  basis  of  a critical /non-critical  division 
of  functions.  This  results  in  a system  wherein  fail  safe  functions  are  performed  in 
dual  Nav/Flight  Control  computers  and  the  flight  critical  autoland  is  performed  in  a 
triplex  computer  arrangement.  In  the  following  discussion  this  system  structure  is 
designated  as  a "Federated  System". 

Another  candidate  system  (Integrated  System)  is  obtained  by  performing  all  auto- 
pilot and  autothrottle  functions,  regardless  of  criticality,  in  a set  of  triply 
redundant  computers  and  navigation  functions  in  separate  computers. 


^ Subsequent  to  1980  this  classification  may  change  to  dispatch  critical  with  a 
minimum  redundancy  requirement  of  fail -op,  but  without  a requirement  for  graceful 
degradation  of  capability  after  first  failure. 
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Based  on  the  previous  discussion,  three  system  configurations  are  developed 
(Figures  1 through  3).  The  analog  computer  arrangement  in  Figure  1 provides  the 
"reference"  for  established  technology.  It  should  be  noted  that  this  particular 
arrangement  shown  is  not  presently  in  service.  Rather,  it  is  a logical  evolution 
of  system  arrangement  based  on  current  requirements,  and  represents  the  level  of 
technical  risk  acceptable  if  a change  in  electronic  technology  - to  digital  - were 
not  also  under  consideration.  (To  attempt  the  trade  study  using  systems  technology 
of,  say,  1969,  would  insert  a definite  bias  factor  which  could  unrealistically 
effect  the  conclusions.) 

Two  types  of  digital  computer  technology  are  considered:  General  Purpose  (GP) 

and  Incremental  (ICP).  The  latter  shares  many  of  the  characteristics  of  analog 
machines;  accordingly,  similar  system  architecture  (Figure  1)  is  postulated  for 
systems  employing  these  machines.  The  similar  characteristics  make  it  possible  to 
treat  the  analog  and  the  incremental  systems  as  synonymous  except  for  software 
development  and  control. 

Application  of  the  general  purpose  digital  computers  to  the  AFCS  are  illustrated 
in  Figures  2 and  3.  These  configurations  were  selected  to  provide  comparative 
evaluation  of  significant  design  considerations  while  minimizing  unnecessary  system 
variables.  Figure  2 represents  an  integrated  autopilot  system  which  provides  the 
greatest  feasible  reduction  of  equipment  and  interface  complexity.  Figure  3 repre- 
sents a system  arrangement  which  provides  greatest  possible  isolation  of  flight 
critical  modes  to  reduce  the  risks  of  failure  modes  oompromising  system  safety  re- 
quirements. 

The  selection  of  these  three  candidate  systems  thus  provides  a means  of  eval- 
uating contrasting  major  design  factors,  that  is: 

1.  Direct  evaluation  of  digital  (General  Purpose  or  Incremental)  vs,  analog 
technology  by  consideration  of  Figure  1 versus  Figure  3; 

2.  Direct  evaluation  of  the  impact  of  substantial  integration  by  consideration 
of  Figure  2 versus  Figure  3;  and 

3.  Direct  evaluation  of  maximum  feasible  benefits  of  the  digital  approach 
by  consideration  of  Figure  1 versus  Figure  2. 

After  selecting  the  basic  candidate  systems,  major  variations  within  a system 
configuration  may  also  be  considered,  as  shown  by  comparing  the  federated  DFCS  illus- 
traded  in  Figures  3 and  4.  The  effect  of  including  variations  will  be  to  provide  a 
band  of  merit  in  the  eventual  study  results.  Such  a band  of  merit  provides  a means 
of  further  assessing  the  sensitivity  of  system  risks/advantage  to  configuration. 


TRADE  STUDY  METHODOLOGY 


The  identification  of  key  parameters  is  fundamental  in  conducting  trade  studies. 
Two  sets  of  parameters  were  identified  to  evaluate  the  alternate  systems,  viz: 

"System  Parameters"  and  "Trade  Parameters". 
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Trade  Parameters  were  selected  to  use  as  a basis  of  comparison  between  major 
features  of  each  system.  The  major  features  were  designated  as  System  Parameters. 
Trade  Parameters  are  weighted  according  to  a Relative  Advantage/Risk  Factor  rationale. 
System  Parameters  are  weighted  In  accordance  with  their  relative  Importance  to  the 
overall  makeup  of  the  system.  System  Parameters  along  with  their  weighting  (relative 
Importance  factors)  are  given  In  Table  II. 


TABLE  II 


SYSTEM  PARAMETER 

FACTOR 

Software  Development,  Verification 
and  Control 

1.0 

I/O  Equipment 

1.0 

System  Test 

0.7 

Sensor  Signal  Selection  and  Fault  Detection 

0.6 

Mode  Logic  and  Interlocks 

0.5 

Interties 

0.5 

Processor  & Memory  Sizing 

0.2 

Control  Law  Implementation 

0.1 

Trade  Parameters  are  defined  as  follows: 


Reliability 


Testabi 1 1 ty 


Moni torabi 1 1 ty 


Maintainability 


The  Impact  which  the  System  Parameter  under  consid- 
eration has  on  the  system  integrity,  operational 
availability  and  ability  to  meet  safety  requirements 
(autoland  and  dispatch  critical  functions). 

The  requirements  Imposed  on  system  test  In  terms  of 
hardware/software  by  the  System  Parameter  being 
evaluated. 

The  requirements  (In  terms  of  hardware,  software  and 
engineertng  development)  to  provide  failure  detection 
for  those  elements  of  the  System  Parameter  being 
evaluated. 

The  Impact  on  system  fault  Isolation  to  the  LRU 
level. 


554 


Growth  Capability  The  ability  of  the  particular  parameter  to 

accommodate  growth  due  to  expanded  system  require- 
ments, or  Improvements. 

Cost  The  impact  of  the  parameter  on  system  cost  in  terms 

of  hardware  requirements  and/or  engineering  develop 
ment  cost. 

Trade  Parameter  weightings  are  given  in  Table  III. 


TABLE  III 


REUTIVE  ADVANTAGE 

RELATIVE  RISK 

WEIGHTING  FACTOR 

Definite  Advantage 

2 

Probabl e Advantage 

1 

No  Advantage 

No  Risk 

0 

Minor  Risk 

-1 

Moderate  Risk 

-2 

Severe  Risk 

-3 

It  will  be  noted  that  the  weighting  system  is  balanced  at  "definite 

advantage"  vs.  "moderate  risk".  Hence,  a severe  risk  will  negatively 

influence  a definite  advantage  making  it  less  desirable. 

Detailed  definition  of  the  descriptive  terms  of  Table  III  are  given  in 

Table  IV. 

The  manner  in  which  the  System  Parameter/Trade  Parameter  weighting  factors  are 
combined  is  shown  schematically  in  Figure  5.  A comparison  across  the  systems  under 
study,  for  a given  System  Parameter  is  used  to  select  the  Advantage/Risk  weighting 
factor  or  score.  Engineering  judgement  enters,  of  course,  into  selecting  the 
Advantage/Risk  score.  However,  two  factors  work  to  minimize  purely  subjective 
influences.  First,  a careful  choice  of  System  Parameters  will  isolate  the  most 
significant  aspects  of  the  system  structure;  likewise  the  choice  of  Trade  Para- 
meters displays  those  features  or  system  characteristics  that  are  regarded  as 
significant  in  choosing  between  competing  systems.  Thus  on  this  level,  tacit 
assumptions  are  either  exposed  or  rendered  nugatory.  Secondly,  the  Advantage/Risk 
scores  are  selected  only  after  detailed  comparative  studies  of  the  System  Parameters 
under  the  aspect  of  the  Trade  Parameters  are  made.  Again,  this  procedure  works  to 
minimize  the  influence  of  subjective  factors.  In  addition,  the  procedure  isolates 
any  relatively  high  risk  items  in  the  system  configuration  that  is  finally  selected 
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TABLE  IV 
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FIGURE  5 

TRADE  STUDY  STRUCTURE 


and  consequently  1t  serves  to  focus  design  efforts  on  critical  items. 

A typical  example  of  this  procedure  taken  from  a recent  trade  study  is  given  in 
the  Appendix. 


STUDY  RESULTS 


Application  of  the  above  methodology  to  the  systems  of  Figures  1,  2,  3,  and  4 
yields  the  data  of  Figure  6.  Summing  the  weighted  rating  of  this  figure  for  the 
various  system  parameters  gives  the  following  overall  figure  of  merit  for  the  systems 
shown  in  Figure  7. 

The  choice  of  an  analog  or  incremental  system  is  not  warranted  because  of  the 
negative  overall  ralative  rating.  The  lack  of  relative  advantages  for  these  systems 
are  a function  of  the  nature  of  the  computers,  Specifically,  they  perform  only  a 
part  of  the  automatic  flight  control  system  tasks,  namely  control  law  calculations. 

The  remainder  of  the  tasks  - self  tests,  mode  logic,  etc.  - must  be  performed  by 
additional,  external  means. 

The  figure  of  merit  indicates  that  the  integrated  system  has  the  greatest  overall 
potential.  However,  by  reviewing  the  results  for  each  of  the  system  parameters  as 
displayed  in  Figure  6,  it  can  be  seen  that  a potentially  high  level  of  risk  is 
associated  with  software  development  and  control.  This  clearly  indicates  that  a 
major  follow-on  effort  is  necessary  to  resolve  the  issue  and  reduce  the  risk. 
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FIGURE  7 

RELATIVE  MERIT  FIGURES 


UNCLASSIFIED  RISK  OR  ADVANTAGES 


Certain  aspects  are  Important  in  the  final  selection  of  a system  which  are 
not  readily  Quantifiable,  such  as  vendor  support,  commonality  of  equipment,  customer 
choices,  ARINC  implications,  or  organizational  aspects.  The  fact  that  the  ICP 
computer  is  available  from  a single  source  would  seem  to  be  a risk  with  regards  to 
the  above  consideration  since  by  selecting  that  architecture  one  would  effectively 
select  the  supplier.  Customer  choices  and  ARINC  implications  tend  to  increase  the 
risk  incurred  by  including  the  non-critical  autopilot  and  autothrottle  functions  in 
the  R-NAV  computer. 

Commonality  in  the  various  computers  used  in  the  airplane  would  benefit  the 
customer  by  reducing  his  maintenance  and  possibly  inventory  costs. 

The  advances  in  the  digital  computer  hardware  state-of-the-art,  through  large 
scale  integration  and  improved  semi-conductor  devices,  reduces  cost  while  increasing 
computational  capacity  as  well  as  increasing  predicted  reliability  by  reducing  the 
number  of  interconnections  within  the  computer.  However,  there  is  the  risk  incurred 
in  the  early  stages  of  application  of  new  technology. 

Failure  modes  effect  and  criticality  analyses  (FMECA)  present  an  area  of  severe 
risk  for  digital  systems.  The  risk  is  in  terms  of  assessing  the  effort  required  to  do 
the  FMECA  and  the  probable  success  achievable.  Results  of  the  studies  done  in  the 
"DOT/SST  follow-on"  program  indicate  that  any  attempt  at  a FMECA  according  to  the 
traditional  approach  may  be  a gargantuan  task  even  with  computer  aided  evaluations. 
Similarly,  contact  with  vendors  have  not  revealed  any  clear  methodology  for  performing 
a thorough  FMECA  of  digital  computers. 

Further  study  is  required  to  assess  the  FMECA  bounds  that  must  be  attained  to 
meet  certification  requirements  with  a digital  autopilot. 

The  FMECA  risk  may  be  alleviated  by  system  design  such  that  the  safety  is 
assured  by  "isolated"  simple  monitoring  devices  which  are  amenable  to  a thorough 
FMECA. 

With  regards  to  the  relative  comparison  of  the  ICP  and  GP  computers  there  is 
no  appreciable  difference  in  the  FMECA  risk. 


CONCLUSIONS 


Interpretation  of  the  results  of  a "relative  merit"  trade  study  - such  as  pre- 
viously described  - can  be  made  only  within  the  frameowrk  of  level  of  confidence.  One 
system  configuration  which  rates  relatively  lower  than  another  cannot  be  concluded  as 
infeasible.  Rather,  the  confidence  of  achieving  the  desired  advantages  is  less  than 
the  confidence  associated  with  the  higher  rates  system. 

The  results  of  a relative  merit  trade  study,  carefully  performed,  can  provide 
quantified  conclusions  which  clearly  indicate  the  best  engineering  solution  for  the 
system  architecture.  Also,  weakness  of  the  chosen  system  are  identified  in  such  a 
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manner  as  to  indicate  the  degree  of  urgency  for  follow-on  engineering  efforts  to 
reinforce  the  weak  points. 

Having  made  relative  comparisons  against  a known  quantity  (in  this  case,  the 
established  technology),  reasonable  predictions  can  be  formed  in  terms  of  the  actual 
engineering  effort  required  to  introduce  the  newer  technology. 
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APPENDIX 


The  following  considerations  are  typical  of  the  judgement  required  to  assess 
the  risk  or  advantage  increments  between  candidate  systems  for  a given  parameter. 

The  system  parameter  discussed  in  this  appendix  is  typical  of  the  various 
parameters  which  must  all  be  considered  to  complete  the  study.  For  the  example 
described  in  this  paper,  there  were  eight  major  parameters  identified. 

I.  INPUT/OUTPUT  STAGE 
GENERAL  NOTES 

1.  General  Purpose  Computer  Configurations 

All  interfaces  for  incoming  and  outgoing  signals  are  accomplished 
within  the  I/O  stage. 

Incoming  signals  are  individually  conditioned  in  dedicated  signal- 
conditioning circuits.  Two  multiplexing  units  are  required,  one  each 
for  critical  and  non-critical  analog  signals.  The  output  of  each  MUX 
goes  through  common  time  gating  circuits  and  a single  A/D  converter,  then 
into  a parallel -load/serial -output  buffer  register. 

Digital  inputs  are  loaded  into  their  respective  buffer  registers 
preparatory  to  being  gated  into  the  computer  memory  for  storage.  The  A/D 
converter  buffer  register,  and  the  digital  input  buffer  registers  are 
gated  as  serial  data  into  the  computer  by  a common  gating  circuit. 

This  arrangement  is  necessary  to  allow  card-level  isolation  between 
critical  and  non-critical  signals.  Common  circuitry  is  always  downstream 
of  adequate  buffering. 

The  output  signals  generated  by  the  computer  are  treated  in  a similar 
fashion,  i.e.,  a single  D/A  conversion  followed  by  individual  signal 
conditioning  as  required. 

Servo  amplifiers  for  elevator  and  aileron  position  servos  are  included 
as  part  of  the  I/O  stage. 

The  high  speed  yaw  dampers  are  independent  analog  systems  comprising 
control  law  calculation,  engage  and  disengage  control,  and  servo  loop 
electronics  in  a oackage  separate  from  the  AFCS  computer.  However,  low 
speed  (flaps  down)  yaw  damping  is  augmented  by  turn  coordination  and  yaw 
damping  control  generated  within  the  AFCS  computer.  Channels  A and  B 
provide  the  upper  and  lower  yaw  damper  augmentation  respectively.  Channel 
C's  augmentation  may  be  used  for  monitoring  purposes  and  as  a switchable 
hot-spare  for  either,  upper  or  lower  yaw  damper. 
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1.  General  Purpose  Computer  Configurations  (continued) 

The  I/O  stage  also  includes  an  interface  between  the  generated  auto- 
throttle commands  and  the  autothrottle  (dual)  servos.  In  a similar 
arrangement  to  the  yaw  damper  augmentation  signals,  channel  C serves  as 
a monitoring  function  and  switchafale  hot  spare  for  autothrottle  control. 


2.  Analog  Computer  Configuration 

The  description  of  the  analog  "I/O"  essentially  follows  that’ given  in 
Note  1,  with  the  following  exceptions: 

a.  Obvious  deletion  of  MUX  requirements. 

b.  "Brickwall"  configuration,  i.e.,  federated  configuration  does  not 
include  interface  mixing  of  critical  and  non-critical  signals.  Only 
critical  signals  are  routed  into  the  analog  computer. 

c.  All  yaw  damping  functions  are  eliminated  from  the  analog  computer 
as  illustrated  in  Figure  1. 
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A COMPARISON  OF  ALTERNATIVE  FLIGHT  CONTROL  COMPUTER  CONFIGURATIONS 

INTEGRATED  GP FEDERATED  GP FEDERATED  IGP/ANALOG 

INPUT/OUTPUT  INPUT/OUTPUT  INPUT/OUTPUT 

The  integrated  I/O  comprises  the  Separating  the  non-critical  from  the  ICP 
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Headquarters  , Aeronautical  Systems  Division  (AFSC) 
Wright -Patterson  Air  Force  Base 


SUMMARY 


A study  was  conducted  to  determine  the  benefits  that  accrue  from  using 
control  configured  vehicle  (CCV)  concepts  and  the  techniques  for  applying  these 
concepts  to  an  advanced  tanker  aircraft  design.  Reduced  static  stability  (RSS) 
and  flutter  mode  control  (FMC)  were  the  two  primary  CCV  concepts  used  in  the 
design.  The  CCV  tanker  was  designed  to  the  same  mission  requirements  specified 
for  a conventional  tanker  design.  A seven  degree  of  freedom  mathematical  model 
of  the  flexible  aircraft  was  derived  and  used  to  synthesize  a lateral  stability 
augmentation  system  (SAS),  a longitudinal  control  augmentation  system  (CAS), 
and  a FMC  system.  Fatigue  life  and  cost  analyses  followed  the  control  system 
synthesis,  after  which  a comparative  evaluation  of  the  CCV  and  conventional 
tankers  was  made.  This  comparison  indicated  that  the  CCV  weight  and  cost  were 
lower  but  that,  for  this  design  iteration,  the  CCV  fatigue  life  was  shorter. 
Also,  the  CCV  crew  station  acceleration  was  lower  but  the  acceleration  at  the 
boom  operator  station  was  higher  relative  to  the  corresponding  conventional 
tanker.  Comparison  of  the  design  processes  used  in  the  CCV  and  conventional 
design  studies  revealed  that  they  were  basically  the  same. 


INTRODUCTION 


In  an  Air  Force  sponsored  study,  conducted  by  the  Boeing  Company,  a CCV 
tanker  was  designed  to  satisfy  the  same  mission  requirements  specified  for  an 
advanced  conventional  tanker  design.  The  purpose  of  this  study  was  to  deter- 
mine the  performance  characteristics,  control  characteristics,  methodology 
for  applying  CCV  concepts,  and  the  design  process  resulting  from  applying  CCV 
concepts.  In  addition  to  RSS  and  FMC,  the  two  CCV  concepts  applied,  maneuver 
load  control  (MLC) , ride  control  (RC)  and  gust  load  alleviation  (GLA)  were 
three  other  concepts  given  consideration. 
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The  objectives  of  the  study  were  to: 

1.  Define  a CCV  configuration 

2.  Synthesize  a control  system  for  the  configuration 

3.  Compare  the  CCV  and  conventional  tanker  designs 

To  achieve  these  objectives,  the  scope  of  the  study  was  expanded 
to  include: 


1.  A parametric  analysis  to  determine  a nominal  size,  weight, 
and  geometry  for  the  CCV. 

2.  Derivation  of  a point  design  by  refinement  of  the  nominal  CCV. 

3.  The  derivation  of  flexible,  rigid  body  and  gust  equations  of 
motion  for  the  control  system  synthesis. 

4.  Flying  quality,  fatigue  and  cost  analysis. 

The  design  procedure  used  in  the  study  is  shown  in  figure  1,  First,  the 
CCV  was  sized  in  a parametric  study,  which  included  two  CCV  concepts.  Next, 
the  CCV  point  design  was  defined;  and,  finally,  a control  system  was  synthesized 
for  the  point  design. 

Overall,  the  methodology  used  in  the  CCV  and  conventional  tanker  studies 
were  the  same.  Equations  of  motion  were  obtained  using  finite  element  methods , 
and  the  control  sjmthesis  was  accomplished  using  the  corresponding  transfer 
functions  and  root  loci.  Neither  the  finite  element,  transfer  function,  nor 
root  locus  methods  are  peculiar  to  CCV  design. 


CONFIGURATION  DEFINITION 
Mission  and  Ancillary  Requirements 

The  specified  mission  requirements  to  which  the  CCV  was  designed  are: 

1.  Design  refuel  range 

2.  Off-load  348,900  pounds  of  fuel  at  the  design  refuel  range, 
Mach  .68  and  30,000  ft 

3.  Personnel  and  cargo  capability 

4.  Cruise  speed:  Mach  .75 
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5.  Rate  of  climb  with  one  engine  out 

6.  Takeoff  ground  roll 

7.  Landing  ground  roll 

Some  of  these  requirements  are  depicted  pictorlally  in  figure  2. 
Other  quantities  used  to  design  and  evaluate  the  CCV  are; 

1.  Gross  weight 

2.  Operating  gross  weight  empty 

3.  Flying  qualities 

4.  Ride  qualities 

5.  Fatigue  life 

6.  Cost 


Parametric  Analysis 


In  a parametric  analysis  a matrix  of  CCV  configurations  was  generated; 
and,  although  each  configuration  was  smaller  than  the  conventional  tanker, 
each  had  the  same  mission  capability.  Furthermore,  each  configuration  had 
the  same  wing  loading  (W/S) , and  thrust  as  the  conventional  tanker.  Because 
of  the  application  of  RSS  and  MLC  however,  each  configuration  had  less  drag, 
a smaller  operating  weight  empty  (OWE) , takeoff  gross  weight  (GW)  and  wing 
area  than  the  conventional  tanker.  From  these  configurations  the  smallest 
CCV  tanker  was  selected  for  more  detailed  study  and  design. 

The  selected  CCV  tanker  configuration  was  refined  through  a detailed 
design  of  the  aerodynamic,  propulsion,  and  structural  subsystems.  The 
result  of  this  refinement,  which  was  constrained  by  the  mission  requirements, 
was  the  CCV  point  design  developed  in  the  study. 

Of  the  two  CCV  concepts  used  in  deriving  the  point  design,  RSS  had  the 
most  extensive  impact  on  the  CCV  external  geometry,  size  and  weight.  Re- 
duction of  the  pitching  moment  requirements  accounts  for  the  impact  of  RSS 
because  these  requirements  largely  determine  the  size  and  location  of  the 
tail  and  control  surfaces,  and  the  location  of  the  wings  and  landing  gear 
relative  to  the  center  of  gravity  (C.G. ).  The  influence  of  RSS  is  summarized 
in  Tables  I and  II  in  which  a comparison  of  various  CCV  and  conventional 
tanker  components  is  shown.  (The  starred  items  in  Table  I were  not  determined 
by  RSS.) 
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In  sizing  the  CCV  the  only  factor  attributed  to  MLC  was  a 10  percent 
reduction  in  wing  weight  because  it  was  assumed  that  any  higher  stresses 
occuring  in  the  lighter  wing  structure  could  be  alleviated  by  an  active 
MLC  system.  However,  for  the  reason  discussed  subsequently  a MLC  system 
was  not  S3nathesized  for  the  CCV,  eventhough  the  assumption  of  a 10  percent 
reduction  had  been  applied  to  the  point  design. 


Point  Design  Description 


The  most  prominent  feature  of  this  design,  illustrated  in  figure  3,  is 
the  absence  of  a horizontal  tail.  Other  design  features  include  a low  wing 
and  four  engines,  of  which  two  are  wing  and  two  are  fuselage  mounted.  A 
tricycle  landing  gear  and  a boom  operator  station  located  in  the  aft  fuselage 
section  also  characterize  the  configuration.  Pitching  and  rolling  moments 
are  obtained  from  the  wing  mounted  elevens,  and  the  rudder  is  used  to  gen-  n 
erate  yawing  moments.  Because  of  RSS,  the  airframe  is  statically  unstable  at 
some  heavy  gross  weight  conditions  which  includes  the  takeoff  condition. 

The  CCV  point  design  represents  an  attempt  to  maximize  the  size  and 
weight  reductions;  and  the  resulting  size  reduction  may  be  observed  in 
figure  4,  in  which  the  external  features  of  the  CCV  and  conventional  tankers 
are  compared. 


TABLE  I 

CCV  AND  CONVENTIONAL  COMPARATIVE  SIZE 


ITEM 

CONVENTIONAL 

CCV 

WING  AREA  (FT^) 

10,640 

8,984 

WING  SPAN  (FT) 

275. 

251.4 

FUSELAGE  LENGTH  (FT) 

197. 

125. 

FUSELAGE  MAXIMUM  DIAMETER  (FT) 

18. 

18. 

HORIZONTAL  TAIL  (FT^) 

2,310 

0 

VERTICAL  TAIL  (FT^) 

1,173 

571.2 

CRITICAL  ENGINE  MOMENT  ARM  (IN) 

767. 

300. 

DESIGN  WEIGHT  (LB) 

1,000,000. 

835,900. 

OWE  (LB) 

334,100 

250,300. 
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TABLE  II 


CCV  AND  CONVENTIONAL  WEIGHT  COMPARISON 


ITEM 

CONVENTIONAL 
WEIGHT  (LB) 

CCV 

WEIGHT  (LB) 

A 

(LB) 

WING 

120,370 

82,650 

37,720 

HORIZONTAL  TAIL 

12,200 

0 

12,200 

VERTICAL  TAIL 

7,070 

3,430 

3,640 

FUSELAGE 

52,900 

35,660 

17,240 

SURFACE  CONTROLS 

9,730 

6 ,590 

3,140 

HYDRAULICS 

5,160 

5,080 

80 

AIR  CONDITIONING 

2,070 

1,190 

880 

LANDING  GEAR 

46,790 

39,110 

7,680 

OTHERS 

73,500 

73,950 

-450 

WEIGHT  EMPTY 

329,790 

247,660 

82,130 

DESIGN  WEIGHT 

1,000,000 

835,900 

164,100 

CCV  MODEL 

The  equations  of  motion  used  in  the  control  synthesis  included  rigid  body 
and  elastic  structural  modes  of  motion.  Finite  element  techniques,  a detailed 
treatment  of  which  may  be  found  in  reference  1 and  other  sources  in  the  lit- 
erature, were  used  to  derive  the  elastic  equations  of  motion.  Briefly,  the 
finite  element  method  is  a technique  in  which  the  structure  is  modeled  by  a 
finite  ntimber  of  nodes  (fig.  5)  connected  by  beams  or  plates  which  act  as 
structural  springs.  The  structural  motion  is  described  by  the  displacement 
and  rotation  of  the  nodes,  at  which  the  forces  and  moments  are  assumed  to  be 
applied. 
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For  lifting  surfaces,  an  aerodynamic  finite  element  method  called  the 
double  lattice  technique  (ref.  2)  was  used,  and  the  application  of  this  tech- 
nique entailed  dividing  each  lifting  surface  into  a finite  number  of  trape- 
zoids (fig.  5).  A set  of  coefficients  relating  the  velocity  normal  to  the 
element  and  the  lift  on  the  element  is  provided  by  the  method.  Also  produced 
by  the,  method  is  the  dynamic  coupling  between  elements  which  for  example, 
describe  the  wing-fin  coupling  responsible  for  the  flutter  mode. 

Ordinary  differential  equations  in  time  with  coefficients  that  are  func- 
tions of  geometry  are  obtained  from  the  application  of  the  finite  element 
technique.  From  a procedure  for  simplifying  the  equations  and  a Boeing 
Company  transfer  function  computer  program,  the  corresponding  transfer  func- 
tions used  in  the  control  synthesis  were  generated.  Although  the  original 
equations  represented  as  many  as  seventeen  degrees  of  freedom,  only  seven 
degrees  of  freedom  were  used  in  the  control  synthesis ; and  these  consisted  of 
three  rigid  and  four  elastic  (structural)  modes  of  motion. 


CONTROL  SYSTEM  SYNTHESIS 


In  synthesizing  the  control  system  no  hovel  design  techniques  peculiar  to 
control  configured  vehicles  were  used. 

Transfer  functions  for  the  seven  degree  of  freedom  model  and  root  loci 
were  used  to  synthesize  a logitudlnal  CAS,  a lateral  SAS  and  a FMC  system. 

The  criteria  to  which  these  systems  were  designed  are  given  below. 


Design  Criteria 

The  control  systems  were  designed  to  existing  military  specifications. 

The  logitudlnal  CAS  and  the  lateral  SAS  designs  were  based  on  the  rigid  body 
flying  quality  requirements  of  MIL-F-8785B(ASG) , and  the  FMC  system  design 
was  based  on  the  1.15V])  criteria  of  MIL-A-8870,  where  Vq  is  the  design  limit 
speed.  The  flying  quality  requirements  are  expressed  in  terms  of  adequate 
stability,  maneuver  response,  natural  frequency,  damping  ratios,  time  constants, 
and  time  to  double;  and  the  flying  qualities  are  characterized  by  satisfactory 
stability,  short  period,  phugoid,  dutch  roll,  spiral  and  roll  subsidence  modes 
of  motion. 


Lateral  SAS  Synthesis 

The  roll  axis  was  unaugmented;  and,  hence,  the  lateral  SAS  consisted  of 
a rigid  body  yaw  damper  only.  The  yaw  damper,  comprised  of  a washout  circuit 
and  a first  order  filter,  provided  the  dutch  roll  damping  required  by 
reference  3. 

Lateral  FMC  Synthesis 

An  antisymmetric  flutter  analysis  revealed  the  need  for  a FMC  system  be- 
cause the  free  airframe  failed  to  meet  the  l.lSVj^  criterion;  that  is,  the 
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second  structural  mode  fluttered  at  a velocity  of  450  KCAS,  which  is  below 
the  1.15Vd  of  477  KCAS. 

A zero  root  locus  analysis  (ref.  4)  was  conducted  to  determine  the  best 
sensor  location  and  which  of  the  elevons  to  use  for  flutter  suppression.  The 
philosophy  of  the  zero  root  locus  approach  is  that  the  distance  between  a 
sensor  or  surface  zero  and  a structural  pole  is  indicative  of  the  coupling 
between  the  sensor  or  surface  and  the  structural  mode.  A greater  distance 
implies  more  coupling  or  more  influence  of  the  surface  on  the  structural  mode 
(fig.  6).  The  result  of  this  analysis  was  the  selection  of  an  accelerometer 
location  (fig.  3)  and  the  inboard  elevon  for  flutter  suppression. 

The  accelerometer  and  inboard  elevon  were  incorporated  in  the  design  of 
a FMC  system,  which  consisted  of  an  inner  and  outer  feedback  loop.  The  inner 
loop  was  the  aforementioned  yaw  damper  and  the  outer  loop  was  a compensated 
acceleration  loop  that  controlled  the  inboard  elevon  for  flutter  suppression. 

Longitudinal  CAS  Design 

Analysis  showed  the  absence  of  a longitudinal  flutter  problem  and,  hence, 
only  a CAS  design  was  required.  Structural  coupling  was  present  in  the 
symmetric  axis,  however,  due  to  the  presence  of  a structural  pole  in  the  vicin- 
ity of  the  short  period  poles  at  high  speeds.  Elimination  of  this  coupling 
(fig.  7)  was  achieved  by  using  the  outboard  elevon  to  which  the  structural  mode 
was  more  strongly  coupled.  Thus,  the  outboard  elevon  provides  pitch  damping 
and  attitude  control  as  well  as  structural  decoupling. 

Maneuver  Load  Control  System 

Steady  state  loads  were  determined  for  the  augmented  CCV  on  the  basis  of 
the  inflight  and  taxi  load  requirements  of  MIL-A-008861A  and  MIL-A-008862A. 
Since  the  structure  was  adequate  for  the  loads  defined  by  these  specifications, 
a MLC  system  was  not  designed. 

Gust  Response  And  Fatigue  Analyses 

Turbulence  response  analyses  were  conducted  to  determine  the  fatigue  and 
ride  characteristics  of  the  augmented  CCV;  and  since  the  ride  was  deemed 
acceptable  and  the  fatigue  life  satisfied  MIL-A-008866A,  neither  a GLA  nor  a 
RC  system  was  synthesized. 

The  gust  analysis  was  conducted  in  the  frequency  domain,  and  the  atmos- 
pheric turbulence  was  a von  Karman  power  spectral  density.  The  ride  quality 
and  the  fatigue  life  were  determined,  respectively,  from  the  turbulence  param- 
eters for  acceleration  (A)  and  fatigue  damage  (Nq). 
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COMPARATIVE  EVALUATION 


The  aforementioned  mission  requirements  specified  for  the  CCV  and  con- 
ventional tankers  are  also  measures  of  aircraft  performance.  Although  an 
absolute  numerical  comparison  of  these  performance  quantities  is  not  gen- 
erally available,  a comparison  based  on  normalized  requirements  is  prodded  in 
Table  III.  A value  of  unity  is  assigned  to  each  requirement  and  thd  perfor- 
mance quantities  are  expressed  relative  to  this  value.  Since  both  aircraft 
were  designed  to  have  the  same  range,  fuel  off-load  capability,  crdise  speed, 
and  cargo-passenger  capacity,  these  quantities  have  the  same  value.  Values 
for  the  rate  of  climb,  takeoff  and  landing  ground  rolls  differ,  however,  be- 
cause the  corresponding  capabilities  were  not  identical  for  both  tankers. 
Although  both  aircraft  had  a higher  rate  of  climb  and  a shorter  takeoff  ground 
roll  than  required,  the  CCV  had  a faster  rate  of  climb  but  a longer  takeoff 
ground  roll  than  the  conventional  tanker.  Furthermore,  the  CCV  landing  ground 
roll  equaled  the  slippery  runway  requirement,  whereas  that  of  the  conventional 
tanker  was  shorter  than  required. 


TABLE  III 

COMPARISON  OF  CCV  AND  CONVENTIONAL 
TANKER  PERFORMANCE 


PERFOKMANCE 

CONVENTIONAL 

CCV 

CCV 

QUANTITY 

PERFOSMANCE 

PERFOKMANCE 

CONVENTIONAL 

RANGE 

1 

1 

1 

FUEL  OFF-LOAD 

1 

1 

1 

PERSONNEL-CARGO 

1 

1 

1 

CAPACITY 

CRUISE  SPEED 

1 

1 

1 

ENGINE  OUT  RATE 

2.1 

4.2 

2 

OF  CLIMB 

TAKEOFF  GROUND 

1.2 

1.1 

.92 

LANDING  GROUND 

1.1 

1.0 

• 

VO 

ROLL  (y  = .1) 
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Also  compared  were  the  flying  quality,  flutter,  ride*  fatigue,  and  cost 
characteristics  of  the  two  tankers.  Except  for  the  roll  performance  specifi- 
cation which  neither  aircraft  met,  the  augmented  aircraft  satisfied  all  of 
the  flying  quality  requirements.  The  roll  performance  specified  by  reference  5 
is  for  30  degrees  of  bank  angle  in  2.5  seconds,  but  the  CGV  and  conventional 
tankers  required  2.7  and  3.75  seconds,  respectively,  to  reach  the  30  degrees. 
Both  tankers  exceeded  the  flutter  requirements  and  both  had  satisfactory  ride 
qualities.  However,  the  CGV  crew  and  boom  operator  station  accelerations  were 
respectively  34  percent  lower  and  15  percent  higher  than  the  corresponding 
conventional  tanker  accelerations.  From  a fatigue  life  analysis  it  was  learned 
that  the  GGV  and  baseline  tankers  accumulated  57  and  44  percent,  respectively, 
of  their  design  fatigue  lives.  Finally,  a cost  summary  comparison,  based  on 
the  purchase  of  one  hundred  tankers,  revealed  that  the  GGV  will  cost  20  percent 
less  (fig.  8) . 


One  of  the  most  important  comparisons  was  between  the  GW  and  OWE  of  the 
two  aircraft.  The  GGV  was  16  and  25  percent  lighter  in  GW  and  OWE,  respec- 
tively. The  primary  importance  of  these  lighter  weights  is  in  the  potential 
economic  advantages.  For  example,  a 25  percent  OWE  reduction  offers  a sig- 
nificant benefit  to  commercial  airlines  which  may  be  occasionally  confronted 
with  low  load  factors. 

It  is  important  to  note  that  the  above  comparisons  were  based  on  a single 
GGV  design  iteration  and  that  additional  iterations  could  alter  the  performance 
and  other  characteristics  of  the  aircraft.  Nevertheless,  these  comparisons 
provide  a valid  basis  for  the  conclusions  that  follow. 

GONGLUSIONS 

From  the  results  of  the  GGV  and  Gonventional  Tanker  studies  the  following 
conclusions  may  be  drawn. 

1.  Significant  reductions  in  GW,  OWE  and  cost  are  the  major  benefits 
resulting  from  the  application  of  GGV  concepts  to  transport  type  airplanes. 

2.  Of  all  the  GGV  concepts,  RSS  has  the  most  extensive  impact  on  the 
airplane  configuration  arrangement  design  and  produces  the  largest  reductions 
in  weight  and  drag. 

3.  The  16  and  25  percent  reductions  in  GW  and  OWE  are  representative 
of  the  maximum  reductions  possible  for  the  specified  mission. 

4.  The  application  of  GGV  concepts  will  not  necessarily  improve  all  of 
the  aircraft  performance  quantities.  For  example,  the  16  percent  GGV  weight 
reduction  was  accompanied  by  longer  takeoff  and  landing  distances,  and  a re- 
duced fatigue  life.  However,  additional  design  Iterations  could  shorten  the 
ground  roll  distances;  and  the  fatigue  life  could  be  improved  by  structural 
redesign  or  the  inclusion  of  other  GGV  concepts  such  as  MLC. 


579 


5.  The  utility  of  GCV  concepts  are  mission  sensitive.  For  example, 
analyses  determined  that  GLA  and  RC  systems  were  unnecessary,  but  a low 
level  mission  which  would  increase  the  probability  of  encountering  larger 
gust  intensities  could  reverse  these  results. 

6.  A GCV  is  an  airplane  the  design  of  which  is  based  on 

a.  The  waiver  of  the  free  airframe  logitudinal  static  stability 
requirement. 

b . The  use  of  control  systems  to  perform  new  tasks  such  as  MLC , 

FMG,  GLA  and  RG. 

7.  Although  active  controls  were  included  in  the  preliminary  design 
stage,  the  preliminary  design  process  for  the  GGV  is  standard  in  that,  first, 
the  airframe  is  statically  designed  after  which  active  control  systems  are 
designed. 

8.  New  handling  quality  criteria  are  needed  because  a demarcation  be- 
tween the  short  period  and  phugoid  modes  is  lacking  at  some  flight  conditions 
for  the  RSS  airframe. 
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Figure  1.-  CCV  design  process 
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RANGE 

Figure  2.-  Flisslon  Profile 
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Figure  7.-  Effect  of  speed  on  short  period- 
structural  coupling. 


Figure  8.-  Life  cost  comparison 
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SUMMARY 


A study  has  been  made  of  the  feasibility  of  modifying  a JetStar  airplane  into  a 
demonstrator  of  benefits  to  be  aehieved  from  incorporating  active  control  concepts  in 
the  preliminary  design  of  transport  type  aircraft.  Substantial  benefits  are  shown  in 
terms  of  fuel  economy  and  community  noise  by  virtue  of  reduction  in  induced  drag 
through  use  of  a high  aspect  ratio  wing  which  is  made  possible  by  a gust  alleviation 
system . An  intermediate  configuration  was  defined  which  helps  to  isolate  the  bene- 
fits produced  by  active  controls  technology  from  those  due  to  other  configuration 
variables , 


INTRODUCTION 


Active  controls  is  a developing  technology  which  could  offer  substantial  payoffs 
for  the  air  transport  industry . Three  aspects  must  be  developed  before  active  con- 
trols is  ready  for  application . These  are:  highly  reliable  fly-by-wlre  systems , 
implementation  of  active  control  functions , and  integration  of  the  active  control  sys- 
tem into  the  airframe  preliminary  design  process.  The  first  of  these,  fly-by-wire, 
is  being  adequately  addressed  in  several  programs  such  as  the  F-8  Digital  Fly-By- 
Wire  (DFBW)  (refs.  1 and  2) . The  second  aspect,  implementation  of  active  control 
functions , is  progressing  rapidly  in  programs  such  as  the  B-52-CCV  flight  tests 
(ref  . 3) . Although  for  single  design  points , the  flight  tests  have  validated  the  pro- 
cedures and  modeling  techniques  used  in  the  designs . Active  control  functions  are 
also  being  introduced  into  operational  aircraft  in  order  to  expand  aircraft  capabilities 
For  example,  the  C-5A  Lift  Distribution  Control  System  (ref.  4)  reduces  wing  fatigue 


Limited  uses  of  active  controls  are  also  finding  their  way  into  initial  designs  to 
improve  performance . For  example , a relaxed  static  stability  system  is  part  of  the 
basic  YF-16  augmentation  system  (ref  . 5)  . 

The  third  aspect , integration  of  active  control  systems  into  the  preliminary 
design  , has  not  progressed  as  rapidly  . It  is  only  through  the  leverage  of  resizing 
the  airframe  that  maximum  performance  benefits  are  possible . The  ATT  system 
studies  (ref  . 6)  included  active  controls  in  their  integrated  preliminary  designs  , 
but  the  designs  were  never  implemented  and  flight  tested , thus  verification  of  the 
predicted  benefits  was  not  possible. 

Active  controls , then , is  clearly  emerging  as  a viable  technology  for  certain  air- 
plane applications . Whether  or  not  it  will  provide  realizable  benefits  for  civil  trans- 
port aircraft  is  unclear.  There  is  a serious  lack  of  flight  verification  that  promised 
performance  benefits  are  actually  achievable  for  transports . Recognizing  this  situa- 
tion , the  NASA  is  considering  various  approaches  for  demonstrating  the  benefits 
possible  from  ACT  in  a way  that  would  develop  confidence  within  the  air  transport 
community  . One  approach  being  considered  is  to  redesign,  modify,  and  flight  test 
an  existing  jet  transport  to  determine  the  ACT  benefits  . 

This  paper  presents  the  results  from  a feasibility  study  into  the  reconfiguration 
of  a Lockheed  JetStar , making  full  use  of  active  controls  in  the  redesign  , in  order  to 
minimize  fuel  requirements . The  emphasis  was  on  the  integration  of  active  controls 
into  the  preliminary  design  in  order  to  maximize  performance  benefits.  In  order  to 
more  effectively  integrate  the  various  aspects  of  active  control , a digital  fly-by- wire 
system  was  assumed  to  be  available  for  system  implementation . 


SYMBOLS 


AR  aspect  ratio 

C wing  chord 

C,  cruise  lift  coefficient 

^CR 

Cj^  lift  curve  slope , per  radian 

a 

L/D  lift-to-drag  ratio 

n normal  acceleration,  g 

z 

S wing  area , feet* 

W weight  , pounds 

A wing  sweep  angle,  degrees 


586 


STUDY  FORMULATION 


Study  Objectives 

The  feasibility  study  summarized  in  this  paper  had  as  its  primary  objectives  to 
determine  whether  substantial  performance  benefits  could  be  shown  from  a syner- 
gistic redesign  of  the  JetStar  airplane  utilizing  Active  Controls  Technology  (ACT) 
concepts,  to  quantify  these  benefits,  and  to  direct  the  configuration  development 
toward  the  most  substantial  benefits  possible  in  the  reduction  of  fuel  consumption . 
The  utilization  of  other  advanced  technologies  was  encouraged  if  the  interaction 
would  enhance  active  control  system  benefits.  This  latter  objective  was  directed 
primarily  at  supercritical  wing  technology,  since  it  was  considered  an  important 
aspect  in  order  to  make  the  study  results  applicable  to  future  transports . An  assess- 
ment was  then  to  be  made  of  the  applicability  of  these  benefits  to  transport  class  air- 
craft in  general . 


Ground  Rules 


The  most  important  consideration  was  to  minimize  fuel  consumption . The 
Model  1329-6A  JetStar  was  to  be  used  as  the  baseline  aircraft  to  which  modifications 
would  be  made  . The  design  was  to  adhere  to  the  following  ground  rules: 

(1)  Maintain  current  design  cruise  Mach  number  (0,82) . 

(2)  Maintain  or  improve  long  range  cruise  speed,  ride  qualities,  handling 
qualities,  range,  and  payload, 

(3)  Limit  redesign  to  the  wing  and  empennage  . Avoid  major  redesign  to  the 
fuselage  and  related  subsystems  . 

(4)  Assume  the  availability  of  a full-time  digital  fly-by-wire  system  with  a 
reliability  equivalent  to  that  of  the  basic  aircraft  structure . 

(5)  Restrict  new  technologies  considered  to  those  that  will  be  ready  for  pro- 
duction application  by  1980  . 


REDESIGN  STRATEGY 


The  approach  used  in  the  JetStar  redesign  was  to  increase  the  lift-to-drag  ratios 
in  all  flight  regimes  by  exploiting  the  use  of  active  controls  technology . Increased 
L/D  in  takeoff,  climb,  cruise,  approach,  and  landing  produced  a direct  reduction  in 
fuel  required.  Summarized  in  figure  1 are  the  major  elements  of  the  redesign 
strategy.  Beginning  with  the  reference  JetStar  aircraft,  the  first  step  was  the 
application  of  supercritical  wing  technology  in  the  redesign  of  the  wing  . The  higher 
wing  thickness  ratios  at  a given  cruise  Mach  number  obtainable  for  supercritical 
airfoil  sections  offer  the  possibility  of  achieving  adequate  mission  fuel  volume  inside 
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the  wing.  The  redesign  then  followed  two  separate  paths,  one  leading  to  an  Inter- 
mediate Configuration  without  ACT  and  the  other  leading  to  an  ACT  Configuration 
which  made  maximum  use  of  an  active  control  system  in  addition  to  supercritical  wing 
technology . The  reason  for  defining  these  two  configurations  was  to  isolate  the  con- 
tribution to  improved  performance  due  to  ACT  alone . The  rationale  utilized  in  the 
ACT  Configuration  evaluation  followed  the  sequence  given  on  the  right  side  of  fig- 
ure 1: 

With  the  supercritical  wings  , reduce  the  wing  sweep  angle  and  increase  the 
aspect  ratio  to  reduce  the  induced  drag . 

Maximize  the  increase  in  aspect  ratio  and  minimize  any  resultant  weight  pen- 
alty by  the  use  of  ACT  to  control  acceleration  response  and  wing  bending 
moments . 

Resize  the  empennage  by  the  use  of  ACT  relaxed  static  stability . 


Wing  Optimization 

Some  of  the  effects  of  the  wing  redesign  process  which  were  anticipated  are 
illustrated  in  figure  2 for  no  ACT  and  ACT . The  general  trends  in  L/D , wing  root 
bending  moment , and  fuel  consumption  are  shown  for  variations  in  aspect  ratio. 

Other  parameters  such  as  wing  thickness , sweep , and  area  affect  the  performance  as 
well,  but  were  expected  to  have  a lesser  effect  than  aspect  ratio.  It  is  seen  that  L/D 
would  be  improved  at  the  same  aspect  ratio  as  that  for  the  JetStar  by  the  deletion  of 
the  external  tanks . Increase  in  aspect  ratio  should  then  provide  major  improvements 
in  wing  efficiency.  However,  as  seen  in  the  second  graph,  an  increase  in  wing  root 
bending  moment  at  the  same  aspect  ratio  as  the  JetStar  would  accompany  the  higher 
lift  curve  slope  of  the  supercritical  wing  section.  Further  increases  in  aspect  ratio 
would  incur  substantial  increases  in  bending  moment  and  would  be  reflected  in 
increased  wing  weight  . An  ACT  system  which  reduces  bending  moment  offers  the 
potential  for  sizable  reductions  in  wing  weight , which  would  be  reflected  in  reduced 
fuel  consumption  . This  simplified  description  suggests  that  optimized  wings  would 
have  aspect  ratios  of  approximately  7 for  no  ACT  and  approximately  9 for  ACT , A 
more  detailed  examination  including  all  of  the  wing  parameters , the  various  practical 
constraints , and  the  ACT  system  burden  was  necessary  to  see  if  the  initial  estimates 
of  aspect  ratio  and  fuel  consumption  were  attainable. 


Wing/Fuselage  Mating  Constraints 

If  a JetStar  were  to  be  used  as  an  ACT  demonstrator  , several  geometrical  con- 
straints would  be  necessary  in  order  to  minimize  modification  costs  relative  to  the 
fuselage  and  major  subsystems . Major  constraints  would  be  the  preservation  of  spar 
attach  points , the  main  landing  gear  attachment  structure , and  stowage  provisions 
for  the  gear  indicated  in  figure  3 by  the  heavy  lines . An  indication  of  the  impact  of 
these  constraints  on  two  candidate  wing  sweeps  (0°  and  20°)  can  be  seen  in  the  fig- 
ure . At  20°  sweep  the  gear  support  structure  occupies  the  area  of  the  inboard  flap 
panel  and  there  is  insufficient  depth  to  house  the  gear.  At  0°  sweep  the  gear  is 
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accommodated , but  there  is  a severe  angle  in  the  rear  spar . From  these  two  candi- 
date wings,  the  impact  of  the  wing/ fuselage  mating  constraints  is  seen  to  be  strongly 
dependent  on  the  specific  wing  configuration  being  considered . The  design  would 
require  an  iterative  process  in  which  a candidate  wing  geometry  is  selected  on  the 
basis  of  performance  considerations . It  would  then  be  examined  from  the  standpoint 
of  geometrical  constraints.  If  it  did  not  meet  these  constraints,  a different  config- 
uration would  be  considered . 


INTERMEDIATE  CONFIGURATION 


Selection  of  the  Intermediate  Configuration  without  benefit  of  ACT  was  heavily 
dependent  upon  matching  the  ride  quality  of  the  basic  JetS tar . Analysis  showed  that 
the  worst  ease  for  the  JetS  tar  was  in  high  speed  descent.  The  criterion  used  in  this 
study  was  a ride  comfort  index  which  was  based  on  acceleration  response  and  was 
proportional  to  wing  lift  curve  slope  divided  by  wing  loading  . To  satisfy  ride  quality 
requirements , therefore , the  Intermediate  Configuration  had  to  have  a relatively  low 
aspect  ratio  wing  with  moderate  sweep  to  reduce  the  lift  curve  slope  and  gust  sensi- 
tivity . Trade  studies  showed  that  a wing  sweep  of  30°  provided  satisfactory  lift 
curve  slope  and  fuel  volume  capability . The  matrix  pf  candidate  wing  geometries  for 
the  Intermediate  Configuration  is  shown  in  figure  4 plotted  against  the  ride  comfort 
index  normalized  with  respect  to  the  JetStar . The  configurations  shown  have  a wing 
sweep  of  30°,  aspect  ratios  from  4 to  6,  and  wing  loading  represented  by  cruise  lift 
coefficients  from  0.30  to  0.40.  For  ride  qualities  equal  to  or  better  than  those  of  the 
JetStar , the  range  of  possible  configurations  varies  from  aspect  ratio  = 4 , 

C,  = 0 . 34  to  aspect  ratio  = 6 where  wing  loading  must  be  increased  to  an  equiva- 
CR 

lent  C^  of  approximately  0.40. 

^CR 

The  selection  of  the  Intermediate  Configuration  is  summarized  in  figure  5 . The 
carpet  plot  shows  fuel  consumption  in  pounds  per  nautical  mile  plotted  as  a function 
of  aspect  ratio  and  cruise  lift  coefficient  for  the  required  1850  nautical  mile  range  . 

The  data  are  provided  for  a constant  wing  sweep  of  30° . Boundary  curves  super- 
imposed on  the  carpet  are  for  fuel  volume , ride  comfort , and  rear  spar  location . 

Those  boundaries  result  in  a small  range  of  feasible  configurations  which  satisfies 
all  requirements . The  selected  configuration  has  an  aspect  ratio  of  5 and  will  cruise 
at  a lift  coefficient  of  0.38.  The  fuel  consumption  is  approximately  8 percent  lower 
than  that  of  the  JetStar  based  on  fuel  used  to  accomplish  the  mission . 

A plan  view  of  the  Intermediate  Configuration  is  given  in  figure  6 . The  wing 
has  an  aspect  ratio  of  5.0,  a sweep  of  30°  at  the  quarter  chord,  a wing  area  of 
490  square  feet , and  a thickness-to-chord  ratio  of  16  percent  at  the  mean  aerodynamic 
chord . No  change  in  the  basic  JetStar  empennage  is  required  for  this  configuration . 
These  characteristics  compare  to  those  of  the  basic  JetStar  which  has  an  aspect  ratio 
of  5.27,  a sweep  of  30°,  a wing  area  of  542  square  feet,  and  a thickness-to-chord 
ratio  of  11.2  percent  . 
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ACT  CONFIGURATION 


Results  from  parametric  studies  to  determine  a candidate  ACT  Configuration  are 
given  in  figure  7 . The  carpet  plot  of  fuel  consumption  for  candidate  configurations 
for  a sweep  angle  of  5.5°  is  based  on  a match  of  the  cruise  segment  range  requirement 
of  1850  nautical  miles . Wing/fuselage  mating  constraints  were  satisfied  at  this  wing 
sweep.  Cruise  altitude  is  assumed  to  be  constant  at  40,000  feet  . All  candidate  eon- 
figurations  shown  on  the  carpet  plot  satisfy  the  ride  comfort  criterion.  Selection  of 
the  ACT  Configuration  is  obtained  from  the  intercept  of  a line  representing  adequate 
fuel  volume  and  a value  of  minimum  fuel  consumption  which  is  achieved  with  an 
aspect  r^io  of  9 and  a cruise  lift  coefficient  of  0 . 38 . This  gives  a fuel  consumption 
figure  of  5.5  pounds  per  nautical  mile.  The  start-of-cruise  wing  loading  is 
60 . 4 pounds  per  square  foot  for  the  ACT  Configuration  compared  to  65 .5  pounds  per 
square  foot  for  the  JetStar . The  ride  comfort  index  of  the  ACT  Configuration  is 
69  percent  of  the  value  of  the  JetStar  and  the  Intermediate  Configuration,  which  is  a 
substantial  improvement  in  acceleration  response  to  turbulence , 


Loads  Analysis 

The  limited  scope  of  this  feasibility  study  necessitated  restricting  the  loads 
investigations  wherever  possible;  accordingly , a single  flight  condition  was  selected 
as  being  typical  of  the  likely  design  condition . The  condition  selected  was  the  cruise 
speed  ease  (350  knots)  at  20,000  feet  altitude  which  represents  a suitable  datum;  the 
effects  of  the  major  increase  in  wing  lift  curve  slope  of  the  supercritical  wing  also 
peak  at  about  this  cruise  Mach  number  of  0.78. 

The  decision  was  then  made  to  base  the  gust  analyses  on  the  discrete  gust  case . 
The  short  duration  of  the  study  did  not  permit  comprehensive  spectral  density 
analyses  of  the  several  configurations  envisaged  , and  the  nonlinearities  due  to  con- 
trol system  limitations  (hinge  moment , authority , and  rate)  were  likely  to  be  more 
significant  at  the  larger  gust  velocities . Hence , the  FAR  25  gust  of  50  feet  per  sec- 
ond with  a (1  - cosine)  profile  over  a length  of  25  chords  was  selected  as  the  study 
basis.  The  overall  lift-curve-slope  value  was  10.2  per  radian  for  the  ACT  Config- 
uration. 

Some  results  of  the  loads  analyses  given  in  figure  8 show  wing  root  bending 
moments  for  both  maneuver  and  gust  load  conditions . Values  for  the  JetStar  air- 
plane are  noted  by  the  symbols . The  results  show  that  gust  loads  are  more  critical 
for  the  aspect  ratio  9 wing  than  those  due  to  maneuver  conditions . Studies  of  aircraft 
response  to  gusts  with  various  gust  alleviation  system  characteristics  resulted  in  the 
selection  of  full-span  trailing-edge  flaps  with  a flap  actuation  rate  of  60  degrees  per 
second  as  the  most  effective  system . The  results  of  dynamic  load  response  at  a flap 
control  rate  of  60  degrees  per  second  show  a reduction  in  flexible  wing  root  bending 
moment  from  13.2  X 10®  in-lb  to  9 .4  X 10®  in-lb,  which  is  of  the  same  magnitude  as 
the  rigid  wing  with  no  ACT  but  is  over  twice  the  value  for  the  JetStar  . The  impact 
of  a wing  with  higher  root  bending  moment  than  the  JetStar  is  the  need  for  a sizable 
wing  carry  through  structure , A doubling  of  the  bending  moment  is  near  the  prac- 
tical limit  for  increasing  the  strength  of  this  carry  through  structure . 
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The  results  further  indicate  that  maneuver  loads  are  relatively  insignificant, 
and  no  appreciable  benefit  would  result  from  the  incorporation  of  a maneuver  load 
control  system  for  this  particular  configuration . The  amount  of  load  alleviation  ob- 
tainable for  the  flexible  aircraft  is  much  less  than  that  for  the  rigid  aircraft;  there- 
fore , the  dynamic  structural  response  must  be  included  In  any  control  system  analy- 
sis. Preliminary  flutter  analyses,  conducted  to  establish  the  torsional  stiffness 
required  for  flutter  and  divergence  prevention  , revealed  no  apparent  problems  . 

The  time  history  of  the  root  bending  moment  response  given  in  figure  9 shows 
the  substantial  reduction  of  the  initial  gust  load  peak  as  a result  of  the  ACT  system . 
There  is  little  effect  on  the  second  (negative)  load  peak.  The  gust-induced  peak 
load  occurs  at  about  0 , 2 second  after  entering  the  gust , which  is  long  before  any 
overall  pitch  response  can  occur.  The  basic  objective  of  the  active  control  system, 
therefore , is  to  destroy  this  lift , rather  than  to  change  the  angle  of  attack . In  an  up 
gust , an  upward  flap  deflection  is  required  together  with  a proportional  downward 
elevator  deflection  to  counteract  the  pitching  moment . The  rapidity  of  the  gust  veloc- 
ity buildup  requires  the  high  flap  rates  discussed  previously . 


ACT  System  Burden 


The  design  to  this  point  has  assumed  the  availability  of  an  ACT  system;  however, 
the  penalty  for  providing  such  a system  must  also  be  assessed  to  determine  practi- 
cality. Ideally,  a relationship  between  system  burden  and  system  capability  could 
be  established  for  incorporation  into  the  wing  definition  process . Unfortunately , 
this  relationship  is  not  easily  defined , as  illustrated  in  figure  10 . Complexity  and 
weight , indications  of  the  system  burden , are  shown  as  a function  of  control  system 
capability.  This  relationship  is  difficult  to  quantify;  thus  , only  a subjective  indica- 
tion of  increasing  system  penalty  with  increasing  capability  is  shown  . 

Lacking  a well-defined  relationship , an  ACT  system  configuration  was  assumed 
which  would  meet  the  needs  of  the  design  . Figure  11  itemizes  the  major  features  for 
this  system  and  indicates  where  it  might  be  placed  on  the  penalty  versus  capability 
plot  , specifically  for  weight  as  the  penalty  and  reduction  in  bending  moment  as  the 
capability . The  gust  alleviation  portion  of  the  ACT  system  involves  five  trailing-edge 
surfaces  and  actuators  on  each  half  of  the  wing . These  surfaces  serve  as  high-lift 
devices  in  addition  to  the  active  control  function  . The  surfaces  are  pivoted  at  the 
75-percent  chord.  The  angular  displacement  limits  for  active  control  are  ±20°  in  all 
segments . Each  surface  segment  is  supported  on  three  hinges , and  the  segments  are 
operated  by  dual-tandem  hydraulic  actuators . For  a 29-percent  reduction  in  root 
bending  moment  corresponding  to  an  actuator  rate  limit  of  60  degrees  per  second , the 
system  would  weigh  approximately  370  pounds  and  would  require  approximately 
6 gallons  per  minute  hydraulic  flow  capacity  . This  burden  was  judged  to  be  reason- 
able from  practical  considerations . 


ACT  General  Arrangement 

A plan  view  of  the  ACT  Configuration  selected  is  shown  in  figure  12 . The  char- 
acteristics of  the  ACT  wing  necessary  to  satisfy  the  objectives  of  this  study  consist  of 


an  aspect  ratio  of  9.0,  a wing  sweep  of  5.5°,  a wing  area  of  560  square  feet,  and  a 
wing  thickness-to-chord  ratio  at  the  mean  aerodynamic  chord  of  12.7  percent  . 

The  horizontal  tail  has  been  reduced  in  size  by  40  percent  as  compared  to  the 
tail  of  the  basic  JetStar.  Of  this  reduction,  75  percent  is  made  possible  by  a smaller 
tail  size  requirement  for  the  ACT  Configuration  wing  to  achieve  the  same  stability 
level  as  that  of  the  basic  JetStar . The  remaining  reduction  is  made  possible  by  a 
relaxed  static  stability  system . 

Plan  views  of  the  Intermediate  Configuration  and  the  ACT  Configuration  are 
compared  in  figure  13.  Large  differences  are  apparent  in  aspect  ratio,  wing  sweep, 
and  horizontal  tail  size.  Both  aircraft  have  supercritical  wing  sections.  The  Inter- 
mediate Configuration  has  no  active  control  technology  applied . As  stated  earlier 
in  the  section  on  REDESIGN  STRATEGY , in  order  to  isolate  the  benefits  attributable 
to  ACT,  all  comparisons  of  performance  were  made  between  the  Intermediate  Con- 
figuration and  the  ACT  Configuration  . 


COMPARISONS 


Comparison  of  Weights 

A comparison  of  weight  buildup  for  the  JetStar , Intermediate  Configuration  , and 
ACT  Configuration  is  presented  in  figure  14.  The  major  differences  occur  in  the 
wing  weight  and  mission  fuel  components . The  Intermediate  Configuration  wing  is 
about  700  pounds  heavier  than  the  JetStar  wing,  primarily  because  of  higher  root 
bending  moments  resulting  from  use  of  the  supercritical  wing . The  wing  weight  of 
the  ACT  Configuration  is  almost  identical  to  that  of  the  Intermediate  Configuration, 
but  it  should  be  noted  that  for  an  aspect  ratio  of  9.0,  a considerable  penalty  would 
have  been  incurred  without  the  benefits  of  active  controls  in  reducing  root  bending 
moments . The  mission  fuel  requirement  is  shown  to  progressively  decrease  from  the 
JetStar  to  the  ACT  Configuration  as  a result  of  the  improved  lift-to-drag  ratios  of 
the  Intermediate  Configuration  and  the  ACT  Configuration . Finally , small  changes 
in  systems  weight  are  reflected  in  the  "miscellaneous"  block,  and  the  ACT  Config- 
uration benefits  from  a 266-pound  reduction  in  horizontal  tail  weight  because  of  its 
smaller  size . The  takeoff  gross  weight  is  38 , 378  pounds , 37,821  pounds , and 
35,470  pounds  for  the  JetStar,  Intermediate  Configuration,  and  ACT  Configuration, 
respectively . Although  the  takeoff  gross  weight  has  been  reduced  a small  amount , 
this  is  a side  effect  of  the  most  important  consideration  of  the  study— minimization  of 
fuel  consumption. 


Comparison  of  Fuel  Usage  Benefits 

The  benefits  in  fuel  consumption  were  derived  from  the  difference  between  the 
Intermediate  Configuration  and  the  ACT  Configuration.  The  fuel  required  to 
accomplish  the  mission  (less  reserves)  was  used  to  calculate  these  benefits . Thus 
the  reduction  in  fuel  consumption  of  the  Intermediate  Configuration  over  that  of  the 
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JetStar  is  8 pereent,  and  the  ACT  Configuration  reduction  over  the  JetStar  is  27  per- 
cent. The  direct  benefit  of  active  control  technology  , i .e ; , the  ACT  Configuration 
over  the  Intermediate  Configuration , is  20  percent . 


Comparison  of  Fallout  Benefits 

An  analysis  of  performance  characteristics  under  FAB,  36  rules  indicated  that 
the  use  of  an  active  control  system  would  reduce  approach  noise  by  6 EPNdB  and 
takeoff  flyover  noise,  under  cutback  power,  by  8 EPNdB.  The  benefits  in  terms  of 
community  noise  would  result  directly  from  the  increase  in  lift-to-drag  ratio  in  the 
high-lift  configuration . The  application  of  active  controls  technology  would  im- 
prove the  ride  comfort  by  31  percent. 


CONCLUSIONS 


A study  has  been  made  of  the  feasibility  of  modifying  a JetStar  aircraft  to  demon- 
strate benefits  which  may  be  achieved  through  active  controls . The  specific  con- 
clusions of  the  study  are: 

(1)  A 20-percent  reduction  in  fuel  consumption  was  attributable  to  active  con- 
trols . 

(2)  No  penalty  was  incurred  in  any  other  performance  parameter  in  order  to 
achieve  a fuel  consumption  benefit . 

(3)  Additional  benefits  in  the  reduction  in  community  noise  and  improved 
passenger  mde  qualities  were  indicated . 

(4)  The  general  relationship  between  control  system  burden  and  capability 
was  not  readily  attainable . For  the  specific  gust  loads  alleviation  and  relaxed  static 
stability  system  studied,  the  burden  was  judged  to  be  reasonable  from  practical  con- 
siderations . 


PROJECTIONS  FOR  NEW  DESIGNS 


The  applicability  of  the  results  of  a feasibility  study  of  this  type  to  transport 
class  aircraft  in  general  is  difficult  to  assess , but  it  is  felt  that  some  generalizations 
are  in  order . The  results  of  this  study  are  consistent  with  those  of  other  similar 
studies  , such  as  the  ATT  system  studies  , in  that  we  can  expect  benefits  in  trans- 
port aircraft  performance  from  incorporating  ACT  in  the  design.  It  should  be  noted, 
however,  that  the  performance  increment  for  a new  design  transport  is  uncertain. 

It  would  be  erroneous  to  assume  that  the  magnitude  of  the  benefits  obtained  in  this 
Study  would  be  realized  in  all  new  transport  designs  . ATT  studies  showed  the  ACT 
benefits  to  be  highly  configuration  sensitive.  In  general,  the  design  strategy 
employed  for  a new  ACT  transport  would  be  essentially  the  same  as  that  used  in 
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this  study , which  includes  wing  optimization  to  satisfy  system  requirements  of  fuel 
volume,  ride  quality,  and  stability  and  control.  There  is  a need  for  a more  realistic 
definition  of  a ride  quality  criterion , since  this  is  an  important  design  parameter  for 
ACT  aircraft . 
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WING  - FUSELAGE  GEOMETRY  CONSTRAINTS 


SWEEP  ANGLE*  0"  SWEEP  ANGLE*  20® 


Figure  3 


RIDE  COMFORT  FOR  COMBINATIONS  OF  ASPECT 
RATIO  AND  CRUISE  LIFT  COEFFICIENT 


Figure  4 


INTERMEDIATE  CONFIGURATION  SELECTION 

A = 30® 


Figure  5 


I NT  E RM  E D I AT  E CON  FIGUR  ATION 
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Figure  6 


ACT  CONFIGURATION  SELECTION 


A =5.5“ 


Figure  7 


EFFECT  OF  ACT  ON  WING  BENDING  MOMENT 


Figure  8 
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EXAMPLE  FOR  GUST  ALLEVIATION 


CANDIDATE  SYSTEM 
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Figure  11 


ACT  CONFIGURATION 

AR=  9.0 


Figure  12 


— • 90 

A SUMMARY  OF  THE  APPLICATION  OF  ACTIVE  CONTROLS  TECHNOLOGY 

IN  THE  ATT  SYSTEM  STUDIES 


R • V . Hood 

NASA  Langley  Research  Center 


SUMMARY 


The  application  of  active  controls  technology  to  subsonic,  long-range 
transport  aircraft  was  investigated  in  three  Advanced  Transport  Technology 
system  studies.  Relaxed  stability  requirements,  maneuver  and  gust  load  allevia- 
tion, and  active  flutter  suppression  were  the  concepts  considered.  A different 
configuration  was  investigated  for  each  of  the  three  airframe  manufacturers, 
and  each  had  a somewhat  different  approach  to  the  application  of  active  con- 
trols technology.  Consequently,  the  results  varied  in  magnitude  between  the 
contractors,  but  several  trends  were  noted.  Relaxed  stability  requirements 
resulted  in  the  largest  benefits  - reduced  weight,  increased  return  on  invest- 
ment, and  decreased  direct  operating  costs.  Maneuver  load  alleviation,  gust 
load  alleviation,  and  flutter  suppression  resulted  in  much  smaller  benefits. 
Prior  to  application  of  active  controls  technology,  a research  and  development 
program  directed  toward  fulfilling  data  base  requirements , establishing  effec- 
tive design  techniques  and  criteria,  improving  systems  maintainability  and 
reliability,  and  demonstrating  technology  readiness  must  be  completed. 


INTRODUCTION 


In  mid-1970,  NASA  initiated  an  Advanced  Transport  Technology  (ATT)  Program 
directed  toward  defining  and  developing  advances  in  technology  which  would  con- 
tribute to  a superior  subsonic  long-haul  transport  aircraft.  The  Langley 
Research  Center  played  a lead  role  in  carrying  out  the  airframe  technology 
portion  of  this  program.  Systems  studies  were  initiated  with  three  airframe 
contractors  early  in  the  program.  These  were  Boeing,  General  Dynamics-Convair, 
and  Lockheed-Georgia.  Subsequently,  assessments  from  the  airline  viewpoint 
were  made  by  United  and  American  Airlines. 

The  major  objectives  of  the  systems  studies  were  to 

- Incorporate  projected  advances  in  aerodynamics , structures  and  materials, 
flight  controls  (including  active  control  concepts),  avionics,  propul- 
sion, and  auxiliary  systems  into  conceptual  configurations 

- Identify  and  quantify  the  potential  benefits  and  costs  of  the  technology 
advances 
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- Define  and  recoinmend  research  activities  required  to  bring  the  advanced 
technologies  to  a state  of  readiness  for  coiomercial  application  by  the 
end  of  this  decade 

The  purpose  of  this  paper  is  to  broadly  summarize  the  results  and  recom- 
mendations  of  the  system  studies  which  are  pertinent  to  the  application  of 
active  controls  technology.  A brief  synopsis  of  the  various  approaches  and  the 
constraints  encountered  during  the  course  of  the  studies  is  included  in  order 
that  the  benefits  might  be  better  understood.  The  reader  is  encouraged  to 
obtain  the  listed  references  if  interested  in  more  details.  The  August  1972 
issue  of  the  Astronautics  and  Aeronautics  (ref.  1)  provides  an  overview  of  the 
Advanced  Transport  Technology  Program  and  the  airframe  manufacturers’  final 
reports  are  listed  as  references  2 through  7 of  this  paper. 


CONCEPTUAL  CONFIGUPATION  STUDIES 


Each  of  the  airframe  companies  studied  several  configurations  having 
varying  cruise  Mach  numbers,  ranges,  and  payloads.  Figures  1,  2,  and  3 show  a 
representative  high-speed  configuration  from  each  contractor.  Other  configura- 
tions having  design  cruise  speeds  as  low  as  M-  0.90  were  studied.  The  Boeing 
configuration  and  the  General  Dynamics  configuration  are  similar  in  concept,  but 
differ  considerably  in  a number  of  details.  Both  are  M - 0.98,  196-passenger, 
3000-nautical-mile  design  range,  three-engine  configurations.  The  primary 
differences  are  engine  and  horizontal  tail  locations.  Lockheed  concentrated  on 
a M - 0.95,  400-passenger,  5500-nautical-mile  design  range,  four-engine  con- 
figuration. These  are  the  configurations  which  will  be  discussed  for  the 
remainder  of  the  paper. 

In  arriving  at  the  above  configurations,  a "baseline**  aircraft  was  defined 
which  incorporated  relaxed  stability  requirements  in  order  that  the  best  cruise 
performance  (lowest  trim  drag)  might  be  obtained  without  regard  to  maintaining 
inherent  stability  requirements.  These  baseline  configurations  had  airframes 
designed  for  100-percent  strength  and  stiffness.  The  eonfigurations  were  then 
examined  to  determine  the  applicabiltiy  of  gust  and  maneuver  load  control,  ride 
quality  control,  and  active  flutter  suppression. 

Each  of  these  functions  were  examined  to  identify  potential  benefits, 
system  functional  design,  cost,  and  weight.  Benefits  associated  with  relaxed 
stability  requirements  were  identified  by  **backing-off **  to  a configuration 
having  conventional  stability  characteristics. 


Relaxed  Stability 

Boeing's  initial  longitudinal  design  philosophy  was  to  select  the  minimum 
horizontal  stabilizer  volume  coefficient,  Vh.  which  would  provide  the  required 
center-of-gravlty  range  as  illustrated  in  figure  4.  The  balance  limits 
selected  in  this  phase  provided  that  the  aft-most  center-of -gravity  location 
would  be  limited  to  the  most-forward  maneuver  point  location  encountered  in  the 
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flight  envelope.  (The  maneuver  point  is  defined  as  that  center-of -gravity 
location  at  which  the  stabilizer  deflection  required  for  a constant  load  factor 
increment  becomes  zero  during  a constant  speed  pull-up.)  Ability  to  trim  the 
aircraft  at  the  landing  approach  condition  with  a reasonable  tail  lift  coef- 
ficient (Ctx.  = -0.80)  determined  the  forward  center-of -gravity  portion. 

t i 

The  early  design  philosophy  resulted  in  configurations  which  were  unstable 
in  large  portions  of  the  flight  envelope  but  stable  during  cruise,  as  shown  in 
figure  5.  In  later  phases  of  the  study,  it  was  found  that  this  balance 
philosophy  did  not  result  in  the  best  cruise  performance,  particularly  for  a 
M = 0.98  configuration  with  two  wing-mounted  engines.  The  wing  was  positioned 
further  forward  resulting  in  a more  aft  loading  envelope  which  in  turn  allowed 
a more  aft  cruise  center-of-gravity  position  to  be  maintained.  The  horizontal 
stabilizer  volume  coefficient  which  provided  a compatible  aft  center-of-gravity 
limit  was  found  to  be  larger  than  the  minimum  volume  coefficient  selected 
earlier,  as  shown  in  figure  4. 

In  sizing  the  vertical  tail,  two  criteria  were  considered:  a minimum 

directional  stability  level  ~ 0*002  deg“l)  and  engine-out  control.  For 

the  configuration  shown  in  figure  1,  the  minimum  directional  stability  level 
was  found  to  be  the  limiting  criterion,  based  an  a two-segment  full-span  rudder. 
With  the  vertical  tail  sized  in  this  manner,  lateral-directional  dynamic  insta- 
bility exists  over  a large  portion  of  the  flight  envelope,  as  shown  in  figure  6* 
This  instability  would  require  a flight-critical  augmentation  system. 

General  D3mamics,  in  investigating  relaxed  stability  requirements , followed 
a similar,  but  somewhat  different,  design  philosophy.  The  configurations 
investigated  were  similar  in  size  to  Boeing Vs,  with  the  horizontal  tail  being 
a low  rather  than  a high  T-tail  arrangement  and  two  wing-mounted  engines  rather 
than  all  three  aft.  Figure  7 illustrates  the  horizontal  tail  volume  selection 
for  both  conventional  and  relaxed  longitudinal  stability  requirements.  In  both 
cases,  nose  gear  unstick  and  ability  to  trim  in  the  high  lift  configuration  are 
considered  in  establishing  the  forward  center-of-gravity  location.  For  the 
conventional  ease,  the  requirement  that  the  static  margin  be  greater  than  or 
equal  to  zero  sets  the  aft  center-of-gravity  limit.  The  criterion  selected  for 
the  aft  center-of-gravity  limit  in  the  case  of  relaxed  static  stability  is  the 
ability  to  trim  the  high-speed  configuration  to  a wing-body  lift  coefficient 
of  1.0  with  a maximum  horizontal  tail  deflection  of  15°.  This  will  leave  about 
a 40-percent  control  power  reserve  to  handle  the  dynamic  aspects  of  upset 
disturbances.  An  operational  forward-to-af t center-of-gravity  range  of 
10-percent  M.A.C.  was  maintained.  Figure  7 implies  that  a 25-percent  reduction 
in  horizontal  tail  area  may  be  obtained  by  employing  relaxed  longitudinal  sta- 
bility concepts. 

Preliminary  studies  conducted  by  Genral  Dynamics  indicate  that  a further 
reduction  in  horizontal  tail  area  (about  20  percent)  may  be  obtained  by  incor- 
porating a geared  trailing-edge  control  on  the  all-movable  horizontal  tail. 
Balance  characteristics  of  such  a configuration  are  shown  in  figure  8. 
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The  major  impact  of  this  balance  concept  identified  by  General  Dynamics 
may  be  summarized  in  terms  of  the  changes  in  structural  weight  and  drag  at  the 
trimmed  cruise  condition*  For  the  Mach  0*98,  two-wing  and  one  aft-mounted 
engine  configuration  shown  in  figure  2,  the  savings  are 

1.  Decreased  drag  at  cruise  - 7 counts  (0.0007) 

2*  Structural  weight  savings  due  to  decreased  drag  = 690  lb  (313  kg) 

In  backing  off  to  a configuration  with  conventional  inherent  stability.  General 
Dynamics  determiend  only  the  penalty  due  to  the  trim  drag  increment  and  did  not 
determine  the  weight  penalty  associated  with  changing  the  size  of  the  horizontal 
tail.  Thus,  the  structural  weight  savings  shown  are  due  only  to  the  decreased 
trim  drag  and  resulting  fuel  savings. 

Implementation  of  this  relaxed  stability  concept  resulted  in  a configura- 
tion which  is  stable  in  cruise,  but  unstable  in  other  portions  of  the  flight 
profile,  requiring  an  artificial  stability  system.  Figure  9 illustrates  a 
typical  flight  profile  with  corresponding  values  of  Mach  number  and  static 
margin. 

Lockheed’s  ground  rules  were  that  their  configuration  would  have  a 
20-percent  M.A.  C.  center-of-gravity  range  and  a positive  static  margin  of 
3-percent  M.A.C.  Thus,  for  the  configuration  shown  in  figure  3,  the  forward 
c.g.  limit  is  constrained  by  nose  wheel  lift  off,  and  the  aft  c.g.  limit  by  the 
ability  of  the  augmentation  system  to  provide  a minimum  of  3-percent  static 
stability. 

Figure  10  illustrates  Lockheed’s  balance  philosophy,  assuming  an  augmenta- 
tion system  with  angle-of-attack  (a)  feedback.  Note  that  as  the  a gain  (K) 
is  increased,  the  stability  line  rotates  downward.  The  horizontal  tail  volume 
is  established  by  the  value  of  K for  which  the  control  system  experiences 
rate  or  displacement  saturation.  Using  this  approach,  a reduction  in  horizontal 
tail  volume  of  0.54  was  obtained  which  resulted  in  a 4 .64-percent  decrease  in 
ramp  weight  and  a 6.11-percent  decrease  in  required  thrust. 

The  vertical  tail  sizing  philosophy  was  essentially  the  same  as  those  of 
Boeing  and  General  Dynamics. 


Load  Alleviation  and  Flutter  Suppression 

In  the  application  of  maneuver  load  alleviation  (MLA) , gust  load  allevia- 
tion (GLA) , and  active  flutter  suppression  (FS),  it  was  found  that  these  func- 
tions were  not  independent  and  had  to  be  considered  at  the  same  time.  Each  of 
the  contractors  included  effects  of  aeroelasticity , multiple  load  sources,  and 
a number  of  different  flight  conditions.  Implications  of  fatigue  and  ride 
qualities  were  also  considered  in  the  application  of  MLA,  GLA,  ai^d  FS. 

For  MLA,  Boeing  considered  using  both  inboard  and  outboard  control  surfaces 
to  shift  the  maneuver  induced  load  inboard.  Figure  11  shows  the  potential  wing 
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box  weight  savings,  considering  only  strength  requirements,  in  terms  of  control 
surface  lift  and  moment  capabilities*  The  wing  of  the  baseline  aircraft  was 
shown  by  analysis  to  be  flutter  free  up  to  the  required  1*2  V])*  Figure  12 

illustrates  the  impact  of  removing  material  by  an  MLA  system  on  the  flutter 
(stiffness)  requirements*  The  additional  material  required  to  prevent  flutter 
is  shown  as  a function  of  the  material  removed  by  the  use  of  MLA*  It  should  be 
noted  that  this  analysis  was  based  on  a configuration  with  no  wing-mounted 
engines.  Configurations  with  wing-mounted  engines  would  possibly  have  greater 
flutter  requirements. 

A fatigue  analysis  was  then  conducted  based  on  the  number  of  ground-air- 
ground  cycles  and  the  percent  damage  due  to  gusts.  Figure  13  illustrates  the 
additional  material  required  to  achieve  acceptable  (gust-induced)  fatigue  damage 
rates  as  a function  of  the  amount  of  material  removed  through  the  application 
of  MLA.  Since  the  fatigue  increment  is  large  relative  to  the  MLA  weight  reduc- 
tion, the  need  for  a gust  alleviation  system  to  reduce  the  gust-induced  fatigue 
damage  is  indicated. 

GLA  was  considered  in  order  to  reduce  material  requirements  for  fatigue 
and  to  improve  ride  qualities.  A center-of -gravity  accelerometer  feedback 
driving  a wing  trailing-edge  surface  to  reduce  gust-induced  vertical  accelera- 
tions which  operated  in  conjunction  with  the  pitch  control  surface  to  maintain 
attitude  was  the  control  system  concept  considered.  Figure  14  illustrates  the 
results  of  a two-degree-of-f reedom  power  spectral  density  gust  analysis. 

Airplane  response  in  terms  of  root-mean- square  eenter-of-gravity  aecelerations 
and  the  associated  flap  angles  are  shown  as  a function  of  acceleration  feedback 
gain.  A gain  of  150  deg/g  was  selected.  Figure  13  shows  the  amount  of  material 
required  for  fatigue  as  a function  of  the  material  removed  when  both  MLA  and  GLA 
are  employed. 

The  application  of  an  active  flutter  suppression  system  in  conjunction 
with  the  MLA  and  GLA  system  was  also  investigated.  The  control  system  concept 
arrived  at  was  an  outboard  trailing-edge  surface  responding  to  a wing-mounted 
accelerometer  signal  fed  back  through  a compensation  filter.  Difficulty  was 
encountered  in  maintaining  stability  of  both  higher  and  lower  frequency  airplane 
modes  while  controlling  the  somewhat  violent  flutter  mode  at  3.8  Hz.  A root 
locus  plot  for  one  of  the  more  promising  filter  designs  is  shown  in  figure  15. 
Although  successful  stabilization  of  the  flutter  mode  was  indicated,  active 
flutter  control  was  not  included  in  the  final  configuration  because  the  added 
weight  due  to  the  control  system  was  approximately  equal  to  the  structural 
weight  savings. 

General  Dynamics  considered  application  of  a ”wing  design  load  control"  to 
their  configuration.  This  concept  was  used  to  reduce  wing  maneuver  loads,  as 
well  as  gust-induced  loads.  Implementation  concepts  which  were  considered 
include: 


1 . Inboard  f lape  ron 

2.  Outboard  spoiler 

3.  A combination  of  inboard  flaperon  and  outboard  spoiler 
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Figure  16  illustrates  the  weight  savings  obtained  through  the  use  of  each  of  the 
above  concepts.  Note  that  the  net  savings  shown  are  the  differences  between 
structural  weight  reductions  and  control  system  weight  additions. 

Since  gust- induced  loads  were  found  to  be  critical  on  the  forward  fuselage, 
further  structural  weight  savings  were  possible  using  the  inboard  flaperon. 
Reductions  in  rms  gust  response  all  along  the  fuselage  were  also  found  using 
this  concept.  Figure  17  illustrates  the  gust  responses  at  different  fuselage 
locations  with  and  without  the  active  control  system-  However,  since  the  struc- 
tural weight  savings  would  not  offset  the  weight  associated  with  the  inboard 
flaperon  system  and  since  the  unaugmented  ride  qualities  were  considered  satis- 
factory, the  inboard  flaperon  was  not  included  in  the  final  results. 

General  Dynamics  also  considered  the  application  of  active  flutter  suppres- 
sion to  the  configuration  incorporating  the  wing  design  load  control  system. 
Various  sensor  and  control  surfaces  were  considered,  in  several  combinations. 
Figure  18  shows  the  degree  of  damping  obtained  with  several  of  these  control 
system  concepts,  as  well  as  the  damping  for  the  unaugmented  airplane.  Two  fuel 
conditions  are  shown. 

Difficulties  were  encountered  in  maintaining  stability  of  a higher  fre- 
quency mode  while  stabilizing  the  critical  flutter  mode.  Also,  the  results 
shown  in  figure  18  were  based  upon  feeding  back  idealized  response  signals. 
Figure  19  shows  the  results  of  a study  on  approximating  such  signals  with 
accelerometers  and  compensation  networks.  This  work,  which  was  not  done  on 
exactly  the  same  configuration  as  that  of  figure  18,  indicates  that  when  sensors 
and  compensation  networks  were  included,  successful  stabilization  of  the  flutter 
mode  is  not  achieved.  However,  due  to  a lack  of  detailed  aerodynamic  data  on 
supercritical  wings  with  leading-edge  (tip)  controls,  no  attempt  was  made  to 
optimize  the  proposed  flutter  suppression  system.  It  was  anticipated  that  suc- 
cessful stabilization  could  be  achieved,  but  the  benefits  would  be  smaller  than 
those  predicted  assuming  ideal  feedback  signals.  The  most  promising  concept 
appears  to  be  the  combination  leading-  (tip)  trai ling-edge  control  system 
investigated  by  Nissim  (ref.  8). 

Fatigue  damage  calculations  were  performed  to  determine  the  effects  of  MLA 
and  GLA  on  the  aircraft  service  life.  Three  configurations  were  investigated 

1.  100-percent  strength  without  active  control  system  (ACS) 

2.  100-percent  strength  with  ACS 

3.  Reduced  strength  with  ACS 

Fatigue  damage  rates  were  calculated  for  two  wing  stations  and  two  fuselage 
stations.  Figure  20  summarizes  the  results  for  the  three  configurations. 

Damage  rates  which  caused  gust,  maneuver,  and  ground-air-ground  cycle  are  pre- 
sented and  all  values  are  normalized  to  the  100-percent  strength  without  ACS 
conf i gurat ion . ^ 

Lockheed  investigated  the  application  of  MLA,  GLA,  and  active  FS  to  the 
configuration  shown  in  figure  3.  They  found  the  use  of  MLA  and  GLA  for  reducing 
peak  loads  to  be  inappropriate  for  their  configuration.  The  maximum  allowable 
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wing-bending  deflections  were  limited  by  ground  clearance  during  rough  surface 
taxi  and  the  maximum  dihedral  for  acceptable  stability  and  control  during 
cruise*  Thus,  the  wing  of  the  large,  four-wing-mounted  engine  configuration  was 
bending-stiffness  critical  and  no  benefits  were  obtained  from  the  application 
of  MLA  and  GLA. 

In  investigating  possible  application  of  an  active  fatigue  load  alleviation 
system,  it  was  found  that  for  this  configuration,  the  ground-air-ground  cycle 
was  the  major  source  of  wing  fatigue  damage*  Thus,  it  was  concluded  that  the 
benefits  of  a fatigue  load  alleviation  system  in  reducing  the  fatigue  damage  on 
their  recommended  configuration  was  negligible.  y 

An  active  flutter  suppression  system  which  would  be  used  only  for  that 
portion  of  the  flight  envelope  between  Vj)  and  1.2  Vj)  was  considered.  This 
was  done  in  view  of  the  catastrophic  nature’  of  most  main-surface  flutter  insta- 
bilities and  the  low  probability  of  making  a first-generation  flutter-suppression 
system  absolutely  reliable.  A flutter  analysis  was  conducted  and  it  was  found 
that  approximately  575  lb  (260  kg)  of  stiffness  material  could  be  removed  in 
lowering  the  flutter  speed  from  1.2  Vj)  to  Vj).  An  active  flutter  suppression 
system  was  not  synthesized;  however,  the  weight  of  such  a system  was  estimated 
and  found  to  be  about  320  lb  (145  kg).  Thus,  a maximum  net  structural  weight 
saving  of  about  255  lb  (115  kg)  per  aircraft  was ’ indicated.  In  resizing  the 
aircraft,  this  becomes  a 500-lb  (227-kg)  or  a 0.17-pereent  reduction  in  operat- 
ing weight.  Lockheed  concluded  that  these  benefits  would  not  justify  the  added 
cost,  complexity,  and  risk  of  an  active  flutter  suppression  system  for  their 
recommended  design. 


SUMMARY  OF  RESULTS 


The  benefits  of  interest  are  weight  savings  and  economics  for  the  selected 
configurations . In  some  cases,  there  is  a fairly  wide  spread  in  the  benfits 
indicated  by  the  various  contractors  since  they  investigated  different  config- 
urations and  had  different  basic  ground  rules.  The  high-speed  configurations 
discussed  in  this  paper  were  found  to  benefit  more  from  ACT  than  did  the 
lower  speed  configurations  Investigated  in  the  system  studies.  The  fact  that 
the  benefits  of  active  controls  are  dependent  on  the  configurations  being 
studied  is  well  recognized.  Research  and  development  recommendations  of  the 
contractors  do  agree  quite  closely.  The  recommendations  presented  herein  are 
general  and  somewhat  broad  in  scope.  For  the  more  detailed,  task-level  recom- 
mendations, the  reader  is  referred  to  references  3,  5,  and  7. 


Benefits 

Figure  21,  from  the  Boeing  study,  shows  the  changes  in  configuration 
resulting  from  the  application  of  active  cGntrols.  Comparing  the  conventional 
technology  airplane  to  the  advanced  technology  airplane  with  active  controls, 
one  can  see  the  differences  in  horizontal  and  vertical  tail  areas.  Figure  22 
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suirmiarizes  the  weight  benefits  attributable  to  the  application  of  active  con- 
trols as  predicted  by  the  contractors*  Some  caution  should  be  used  in  examining 
this  figure.  Mote: 

1.  Boeing  indicates  benefits  attributable  to  MLA  and  GLA  and  FS  in  terms 
of  structural  weight,  not  resized  aircraft  TOGW  or  OWE. 

2.  The  weight  savings  shown  for  ESS  by  General  Dynamics  includes  no 
weight  savings  based  on  resizing  the  vertical  tail,  but  is  based  only 
on  the  reduced  trim  drag. 

In  addition  to  weight  savings,  each  of  the  contractors  was  able  to  minimize 
the  trim  drag  through  relaxing  stability  requirements.  This  resulted  in  opera- 
tional benefits,  such  as  reduced  fuel  requirements,  which  will  be  reflected  in 
Direct  Operating  Cost  (DOC)  improvements  to  be  discussed  below.  None  of  the 
contractors  included  systems  specifically  for  improving  the  ride  qualities^  as 
these  were  predicted  to  be  adequate.  However,  reductions  in  fuselage  accelera- 
tions of  20  to  40  percent  were  considered  feasible.  Fatigue  damage  rates  due 
to  gust  and  maneuver  loads  were  either  improved  or  at  least  not  increased  due  to 
the  application  of  MLA  and  GLA,  as  shown  in  figures  14  and  20.  The  impact  on 
the  ground-air-ground  cycle  fatigue  damage,  .however,  does  appear  to  be 
detrimental. 

Two  economic  measures  were  utilized:  Return  on  Investment  (ROI)  and 

Direct  Operating  Costs  (DOC).  Figure  23  summarizes  the  percent  increase  in  ROI 
resulting  from  the  application  of  active  controls.  Again,  note  that  the  General 
Dynamics  results  for  relaxed  stability  include  only  the  effect  of  reduce  trim 
drag.  Boeing  used  a somewhat  different  approach  in  their  economics  study  and 
did  not  show  the  effects  of  only  active  controls  on  ROI  or  on  DOC.  Airplane 
price,  which  was  an  input  to  the  ROI  calculations,  was  estimated  to  be  4.0  to 
6.0  percent  lower  when  active  controls  were  used  (refs.  4 and  6). 

Figure  24  summarizes  the  findings  with  respect  to  DOC,  which  includes  such 
factors  as:  maintenance  (airframe,  engines,  avionics,  etc.),  fuel  usage, 

insurance,  and  other  operating  expenses.  In  general,  application  of  active 
controls  would  reduce  structural  weight  which  would  result  in  lower  maintenance 
costs  for  the  airframe  and  engine.  However,  avionics  maintenance  costs  would 
increase.  Reduced  trim  drag  would  result  in  lower  fuel  costs.  As  can  be  seen, 
the  overall  effect  of  applying  active  controls  was  seen  to  be  beneficial  in 
terms  of  DOC.  More  comprehensive  economic  studies  have  since  been  completed 
and  are  contained  in  reference  9. 


Recommended  Research  and  Development 

The  recommendations  of  interest  will  be  summarized  under  three  broad 
headings : 


A.  Research  and  Technology  (R&T)  Base 

B.  Integrated  Design  Concepts 

C . Technology  Demons  trat ion 
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A.  Research  and  Technology  Base 


1*  Conduct  analytical  and  experimental  (wind-tunnel)  evaluation  of  charac- 
teristics of  leading-edge  and  trailing-edge  devices  designed  for  opera- 
tion on  supercritical  wings.  Both  static  and  dynamic  data  are  required 
for  speeds  through  the  transonic  flow  regime. 

2.  Develop  improved  aeroelastic  methods  for  flight  controls  analysis. 

The  accuracy  of  this  method  should  be  established  by  comparisons  with 

wind-tunnel  and  flight  test  data  and  the  sensitivity  of  airplane 
balance  and  flight  control  design  to  the  accuracy  of  the  method  should 
be  established. 

3.  Develop  control  laws  which  are  compatible  with  advanced  onboard  com- 
puting systems  and  which  maintain  effectiveness  of  the  system  over  the 
entire  operating  flight  envelope. 

B.  Integrated  Design  Concepts 

1.  Conduct  a detailed  study  of  structural  design  criteria  and  handling 
qualities  requirements  for  vehicles  designed  with  active  control  con- 
cepts included. 

2.  Carry  out  a survey  of  operational  flight  conditions  to  point  out  the 
critical  load  cases.  This  survey  should  cover  the  effects  of  angle- 
of-attack  and  Mach  number  variations,  aeroe last! city,  control  surface 
deflection  and  rate  limits,  and  both  clean  and  high  lift  configurations. 

3.  Develop  design  methods  which  are  more  suitable  for  use  in  preliminary 
design  allowing  rapid  trade  studies  between  active  and  passive 
techniques. 

4.  A detailed  design  study  should  be  conducted,  integrating  the  active 
controls  early  in  the  design  process  (control  configured  vehicle 
concept),  optimizing  the  control  systems,  and  establishing  the 
resulting  benefits. 

C.  Technology  Demonstration 

1.  Design  validation  under  actual  flight  conditions  will  provide  the 

degree  of  confidence  required  prior  to  incorporation  of  active  control 
concepts  into  commercially  certifiable  transport  airplanes.  This 
flight  test  program  could  be  accomplished  using  existing  airplanes. 


Airline  Assessment 

Under  contract  to  NASA,  United  Air  Lines,  Inc.,  conducted  an  assessment 
of  the  system  studies  (ref.  10) . American  Airlines  was  awarded  a similar  con- 
tract and,  although  their  results  are  not  published  as  yet,  they  appear  to  be 
reaching  conclusions  quite  like  those  of  United. 
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The  primary  area  of  concern  to  an  aircraft  operator,  is  that  of  systems 
reliability  and  maintainability.  They  recommended  that  a great  deal  of  effort 
be  put  into  systems  which  would  allow  the  operators  to  detect  system  degrada- 
tion and  apply  preventive  or  progressive  corrective  actions  prior  to  complete 
system  failure.  The  maintenance  procedures  should  be  given  a great  deal  of 
thought  by  both  the  manufacturers  and  the  airlines  to  insure  that  the  mainte- 
nance program  which  evolves  will  be  simple,  timely,  and  responsive  to  the  air- 
line desires^  It  was  felt  that  the  benefits  offered  by  active  control 
concepts  would  be  seriously  degraded  if  necessary  to  include  mechanical  backup 
systems  in  the  aircraft.  All,  or  major  portions,  of  an  active  control  system 
will  be  required  to  be  operative  prior  to  flight . Consequently,  the  level  of 
redundancy  must  be  such  that  dispatch  will  be  possible  with  one  system  inopera- 
tive and  must  sustain  a second  failure  in  flight. 

Demonstration  and  service  life  evaluation  in  flight  of  realistic  active 
control  systems  was  considered  to  be  almost  essential.  Several  on-going  and 
complete  active  control  demonstration  programs,  such  as  the  Air  Force  CCV 
program  with  the  B-52,  were  noted.  However,  the  airlines  would  like  to  have 
years  of  operational  experience  rather  than  hours.  It  was  recommended  that 
gust/maneuver  load  control  and  ride  quality  control  systems  be  retrofitted  into 
several  contemporary  aircraft  in  such  a manner  that  current  operations  are  not 
disrupted.  This  would  allow  protracted  service  life  evaluation.  It  was  felt 
that  this  approach  would  not  only  benefit  future  aircraft,  but  could  prolong 
existing  aircraft  life.  Such  retrofit  systems  would  be  designed  such  that  the 
aircraft  would  be  able  to  dispatch  with  the  system  failed.  Thus,  redundancy 
requirements  would  be  much  less  critical  for  these  installations. 


There  was  more  concern  expressed  by  the  airlines  about  the  technology 
readiness  of  relaxed  stability  and  flutter  suppression  systems,  primarily 
because  of  the  flight-critical  nature  of  these  functions  and  apparent  remoteness 
of  the  solution  to  the  system’s  reliability  problem.  They  felt  the  basic  study 
programs  should  be  accelerated  utilizing  both  ground-based  and  research  flight 
experiments.  Contemplated  hardware  for  relaxed  stability  could  be  installed 
in  current  aircraft,  performing  other  functions,  to  gain  in-service  life  data. 
United  stated  that,  from  their  experience,  there  is  no  substitute  for  the  air- 
craft as  a test  bed  and  no  laboratory  or  test  cell  yet  has  adequately  simulated 
the  aircraft  environment. 


CONCLUSIONS 


Although  somewhat  different  approaches  were  taken  in  these  system  studies, 
a number  of  interesting  possibilities  for  applying  active  controls  technology 
were  indicated.  However,  there  is  a need  for  further  in-depth  studies  which 
would  introduce  the  active  control  concepts  earlier  in  the  design  process  and 
in  a more  integrated  manner. 

Relaxing  the  stability  requirements  offered  the  greatest  benefit  and  was 
the  only  concept  included  in  the  initial  design  process.  Flutter  suppression 
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offered  the  smallest  benefit  according  to  the  results  of  two  of  the  contractors 
and  was  identified  as  being  the  concept  most  removed  from  the  current  state  of 
the  art  by  all  of  the  contractors . Maneuver  load  alleviation  and  gust  load 
alleviation  were  found  to  yield  significantly  smaller  benefits  than  relaxed 
stability  requirements;  however,  the  contractors  pointed  out  that  these  concepts 
should  be  Introduced  at  the  initiation  of  the  design  process  in  order  to  maxi- 
mize the  benefits. 

Each  of  the  contractors  pointed  out  areas  where  the  benefits  could  have 
been  greater  if  more  data  and/or  more  time  were  available  for  design  refinements 
and  system  optimization.  Problem  areas  or  areas  of  concern  encountered  by  the 
contractors  in  the  course  of  the  system  studies  were  reflected  in  the  recom- 
mended research  and  development  tasks.  Based  on  the  results  of  these  studies, 
it  appears  as  though  active  controls  technology  can  provide  significant  benefits 
when  applied  to  subsonic,  long-range  transport  aircraft.  However,  application 
will  require  completing  a research  and  development  progfam  directed  toward 
fulfilling  data  base  requirements,  establishing  effective  design  techniques 
and  criteria,  improving  systems  maintainability  and  reliability,  and  demon- 
strating technology  readiness. 
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FIGURE  L BOEING  M=a98,  195  PASSENGER  CONFIGURATION 

(From  ref.  2) 
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FIGURE  2.  GENERAL  DYNAMICS  M=0.98,  195  PASSENGER  CONFIGURATION 

(From  ref.  4) 
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FIGURE  4.  BOEING  HORIZONTAL  TAIL  SIZING  PHILOSOPHY 

(From  ref.  2) 


FIGURE  6.  UTERAL-DIRECTIONAL  DYNAMIC  STABILITY,  UNAUGMENTED 

(From  ref.  2) 
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: FIGURE  7.  GENERAL  DYNAMICS  HORIZONTAL  TAIL  SIZING  PHILOSOPHY 

(From  ref.  4) 
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HORIZONTAL  TAIL  VOLUME, 

FIGURE  8.  BALANCE  CHARACTERISTICS  - ALL  MOVABLE  HORIZONTAL  TAIL  PLUS  GEARED  TRAILING  EDGE 

(From  ref.  4) 
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FIGURE  9.  VARIATION  OF  AERODYNAMIC  STATIC  MARGIN  DURING  TYPICAL  FLIGHT  PROFILE 

(From  ref.  4) 
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FIGURE  15.  FLUTTER  MODE  CONTROL  ROOT  LOCUS  PLOT 
(From  ref.  2) 
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FIGURE  17.  RIDE  QUALITY  BENEFITS  OF  GUST  ALLEVIATION 

(From  ref.  4) 
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FIGURE  18.  FLUTTER  SUPPRESSION  - REDUCED  DESIGN  LOADS  WING 

(From  ref.  4) 
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FIGURE  19.  FLUTTER  SUPPRESSION  - CURRENT  TECHNOLOGY  IMPICIVIENTATION 

(From  ref.  4) 


FIGURE  20.  FATIGUE  DAMAGE  RESULTS 
(From  ref.  4) 
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FIGURE  21.  ACTIVE  CONTROLS  TECHNOLOGY  APPLICATION 

(From  ref.  2) 
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FIGURE  22.  PERCENT  WEIGHT  SAVINGS 


CONTRACTOR 

RELAXED 

STABILITY 

MU  & GU 

F.  S. 

TOTAL 

BOEING 
(REF.  2) 

N.A. 

N.A. 

N.A. 

N.A. 

GENERAL 
DYNAMICS 
(REF.  4) 

4.0% 

(TRIM  DRAG 
EFFECT) 

4.7% 

2.8% 

11.5% 

LOCKHEED 
(REF.  6) 

8. 0% 

-0- 

-0- 

8.0% 

FIGURE  23.  PERCENT  IMPROVEMENT  IN  RETURN  ON  INVESTMENT 
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FIGURE  24.  PERCENT  IMPROVEMENT  IN  DIRECT  OPERATING  COSTS 
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TO  SUPERSONIC  TRANSPORTS 


Kermit  G.  Pratt 

NASA  Langley  Research  Center 
ABSTRACT 


Results  are  drawn  from  In-house  studies  and  from  several  contracted  system 
studies  of  the  impact  of  advanced  technologies  on  the  design  of  an  arrow-wing 
configuration.  Information  presented  includes  estimated  benefits,  effects  of 
combinations  of  active  control  concepts,  and  constraints.  Emphasis  is  placed 
on  characteristics  that  are  uniquely  related  to  a large  airframe  featuring  a 
slender  body  with  a fixed  wing  of  low  aspect  ratio,  high  sweep,  and  small 
thickness  ratio. 


SUMMARY 


The  benefits  of  the  application  of  active  controls  to  supersonic  transport 
airplanes  are  surveyed.  Results  are  drawn  from  in-house  studies  and  from 
several  contracted  system  studies  of  the  impact  of  advanced  technologies  on  the 
design  of  an  arrow-wing  configuration.  The  characteristics  that  are  uniquely 
related  to  a large  flexible  airframe  featuring  a slender  body  with  a fixed  wing 
of  low  aspect  ratio,  high  sweep,  and  small  thickness  ratio  are  discussed, 
particularly  with  regard  to  the  need  for  the  various  active  controls  concepts 
and  to  the  constraints  to  benefits.  The  results  Indicate  that  significant 
benefits  can  be  obtained  with  a configuration  that  is  inherently  longitudinally 
unstable  in  subsonic  flight  and  is  stabilized  by  active  controls.  These  bene- 
fits may  be  increased  by  use  of  center-of -gravity  control  and  angle-of-attack 
limiting.  Benefits  from  maneuver  and  gust  load  alleviation  may  be  small.  In 
any  case,  load  alleviation  most  likely  will  require  that  flutter  suppresion  be 
used  as  well.  Flutter  suppression  in  itself  may  provide  some  saving  in  struc- 
tural weight.  Ride  quality  control  by  a mode  suppression  system  may  be  needed 
for  passenger  acceptance.  For  safety,  active  lateral  control  should  be  con- 
sidered for  limiting  the  magnitude  of  the  transient  motion  due  to  an  engine 
unstart. 


INTRODUCTION 


In  the  course  of  the  United  States  Supersonic  Transport  (SST)  program  it 
was  necessary  for  the  designers  to  utilize  active  controls  to  stabilize  an 
inherently  unstable  vehicle  in  order  to  achieve  an  economically  competitive 
and  safe  airplane.  This  concept  is  frequently  referred  to  as  relaxed  static 
stability. 
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Subsequently,  as  a part  of  research  efforts  to  advance  supersonic  tech- 
nology, several  studies,  both  in-house  and  by  contract,  were  undertaken  by  the 
NASA  to  explore  the  potential  for  improvements  in  SST  designs  by  a more  exten- 
sive use  of  ACT.  Results  from  these  NASA  studies  together  with  some  from  the 
U.S.  SST  program  are  summarized  herein  in  terms  of  estimated  benefits,  effects 
of  combinations  of  ACT  concepts,  and  constraints.  The  candidate  ACT  concepts 
included  relaxed  static  stability,  load  alleviation,  and  mode  and  flutter 
suppression,  fknphasis  is  placed  on  characteristics  that  are  uniquely  related 
to  a large  airframe,  featuring  a slender  body  with  a fixed  wing  of  low  aspect 
ratio,  high  sweep,  and  small  thickness  ratio. 

The  information  is  organized  in  the  following  sequence.  Information 
sources  are  identified  and  briefly  described.  Fixed-wing  SST  characteristics 
that  are  pertinent  to  ACT  are  reviewed.  Results  from  the  various  sources  are 
collected  under  three  main  topics  that  reflect  the  manner  in  which  the  airplane 
is  affected  by  groups  of  the  various  concepts.  Relaxed  static  stability, 
center-of-gravity  control,  and  angle-of-attack  limiting  are  discussed  under  the 
heading  of  Performance,  Airframe  Efficiency,  and  Handling  Qualities.  Flutter 
suppression,  maneuver  load  alleviation,  and  gust  load  alleviation  are  considered 
under  the  heading  of  Wing  Structural  Weight.  Gust  acceleration  alleviation  and 
mode  suppression  are  placed  under  the  heading  of  Ride  Quality. 


SYMBOLS 


A 

AC 

c.g. 

c 


g 


gust  sensitivity  factor,  ^An^^w 

g 

aerodynamic  center 
center  of  gravity 
chord 

average  chord 

local  lift  coefficient 

lift  coefficient 

lift  curve  slope 

maximum  lift  coefficient 

zero-lift  pitching-moment  coefficient 

spanwise  lift  distribution  coefficient 

acceleration  of  gravity 
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L/D 

M 

MAC 

An 

q 

y 

a 

a 

ACT 

FAA 

GAG 

GLA 

HSAS 

MLA 

NASA 

RSS 

SAS 

SCAT 

SST 

TOGW 


lift-to-drag  ratio 

Mach  number 

mean  aerodynamic  chord 

incremental  vertical  acceleration 

dynamic  pressure 

gust  velocity 

running  weight  of  structure 
distance  along  span 
angle  of  attack 
root-mean-square  value 
active  control  technology 
Federal  Aviation  Administration 
Ground- Air- Ground  (cycle) 
gust  load  alleviation 

hardened  stability  augmentation  system 
maneuver  load  alleviation 

National  Aeronautics  and  Space  Administration 
relaxed  static  stability 
stability  augmentation  system 
supersonic  commercial  air  transport 
supersonic  transport 
take-off  gross  weight 

INFORMATION  SOURCES 


The  survey  reported  herein  is  based  on  information  from  the  sources 
described  below.  The  numbers  designating  each  source  are  used  for  identifica- 
tion in  the  subsequent  sections  of  this  paper. 
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1.  The  U.S.  SST  Program,  FAA 

2.  SST  Technology  Follow-on  Program,  FAA 

3.  Studies  of  the  impact  of  advanced  technologies  applied  to  a conceptual 
supersonic  aircraft  configuration,  NASA 

4.  Langley  Research  Center  in-house  studies 

The  subject  matter  from  Sources  1 and  2 deals  with  the  ibilization  by 
active  controls  of  an  inherently  longitudinally  unstable  air^  .ane.  An  illus- 
tration of  this  airplane  is  shown  in  figure  1.  The  airplane  structure  and 
control  system  design  was  developed  in  depth.  Aeroelastic  effects  are  con- 
sidered. Material  pertinent  to  active  controls  is  documented  in  reference  1. 

Source  3 consists  of  three  contract  design  studies  related  to  an  arrow- 
wing configuration,  illustrated  in  figure  2,  which  was  derived  from  the  NASA 
SCAT-15F  concept.  The  consideration  of  active  controls  constituted  only  a 
small  fraction  of  the  total  effort.  The  active  control  concepts  treated  by 
the  individual  contractors  are  listed  below. 

Contractor  ACT  Concepts  Cruise  Mach  No. 

a.  Relaxed  static  stability  2.7 

Center-of-gravity  (c.g.)  control 
(c. g.  location  measurement) 

Angle-of-attack  limiting 

b.  Relaxed  static  stability 

Maneuver  load  alleviation  2.2 

Gust  load  alleviation 
Flutter  suppression 

c.  Relaxed  static  stability  2.7 

The  results  from  Source  3 are  not  published. 

Source  4 consists  of  two  studies: 

a.  A preliminary  assessment  of  active  controls  benefits  to  an  arrow-wing 
configuration  (fig.  2) . The  effects  of  relaxed  static  stability,  maneuver  and 
gust  load  alleviation,  flutter  suppression,  and  ride  quality  control  were 
considered. 

b.  Follow-on  design  development  of  the  arrow-wing  configuration.  Studies 
are  in  progress  on  alternate  methods  of  balancing  the  airplane  to  improve 
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performance.  Changes  in  the  wing  camber  and  twist  of  the  baseline  airplane  to 
improve  the  cruise  lift-drag  ratio  and  the  use  of  relaxed  static  stability  and 
angle-of-attack  limiting  for  subsonic  flight  are  being  investigated. 

The  results  from  Source  4 are  not  published. 


SST  CHARACTERISTICS 


Some  of  the  characteristics,  unique  to  the  fixed-wing  SST  configuration, 
result  in  design  problems  that  active  controls  may  resolve.  However,  some  of 
these  characteristics  also  place  constraints  on  the  benefits  of  active  control 
application.  These  characteristics  are  summarized  below,  together  with  remarks 
on  their  effects.  Some  of  the  geometric  characteristics  are  illustrated  in 
figures  1 and  2. 


Large  Sweepbaek  and  Low  Aspect  Ratio 


Advantages 

1. 

Higher  cruise  lift-dr^g  ratiq 

2. 

Lower  sonic-boom  overpressure 

Disadvantages 

1. 

Low  maximum  lift  coefficient 

requires  low  wing  loading  for  reasonable 

landing  speeds 

2. 

Long  chord  lengths,  together  with  structural 
requirements,  limit  the  ratio  of  trailing-edge 
control  surface  chord  to  wing  chord  to  small 
values.  The  ratios  of  control  surface  areas 
to  wing  area  are  small. 

3. 

Structure  contains  a large  amount  of  minimum 
gage  material 

Small  Wing  Thickness  Ratio 

Advantages 

1. 

Lower  drag 

2. 

Low  stiffness  plus  sweepbaek  provides  some 
inherent  load  alleviation  by  aeroelastic  effects 

Disadvantages 

1. 

Low  stiffness  results  in  reduced  control 
effectiveness  from  aeroelas ticity 

2. 

Low  flutter  speeds 

3. 

Low  natural  structural  mode  frequencies 
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Long,  High-Fineness  Ratio  Fuselage 


Advantages 

1. 

Provides  adequate  payload  volume 

2. 

Lowers  sonic-boom  pressure 

Disadvantages 

1. 

Low  natural  bending  frequencies 

2. 

Aeroelastie  effects 

Aft-Mounted  Engines 

Advantages 

1. 

Favorable  airframe  interference  for  propulsion 
efficiency 

2. 

Low  noise  in  passenger  compartment 

Disadvantages 

1. 

Creates  balance  problem  due  to  aft-located 
heavy  weight 

2. 

Contributes  to  lower  flutter  speeds 

3. 

Space  occupied  by  engines  reduces  available  area 
for  t railing-edge  control  surfaces 

Large  Dynamic  Pressure 

Disadvantages  1.  Aggravates  adverse  aeroelastie  effects  such  as 

loss  of  control  effectiveness 


RESULTS 


Performance,  Airframe  Utilization  Efficiency, 
and  Handling  Qualities 


Relaxed  Static  Stability 

Essentially  all  recent  SST  studies  (Sources  1,  2,  3a,  3c,  and  4b)  have 
advocated  the  use  of  a hardened  stability  augmentation  system  (HSAS)  to  provide 
safe  handling  qualities  for  an  SST  configuration  that  is  inherently  statically 
unstable  at  subsonic  speeds.  Hardened  means  that  the  reliability  must  equal 
that  of  the  airframe  structure.  Source  3b  considers  a neutrally  stable  air- 
plane with  a nonhardened  SAS.  Benefits  include  either  increased  range  for  a 
given  payload  (416  km  (225  n.  mi.)  from  Sources  1 and  2)  or  increased  payload 
for  a given  range.  Benefits  from  Source  3b  were  expressed  in  terms  of  a 
reduced  take-off  gross  weight  (TOGW)  of  a resized  airplane  having  a fixed 
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payload  and  range.  The  reduction  in  TOGW  was  estimated  to  be  about  18,000  kilo- 
grams (40,000  lb)  for  a baseline  TOGW  of  338,000  kilograms  (750,000  lb). 

These  benefits  accrue  from  an  improved  lift-drag  (L/D)  ratio  for  both 
cruise  and  low-speed  flight,  along  with  a more  efficient  utilization  of  air- 
frame volume,  while  retaining  safe  handling  qualities.  The  need  for  an  HSAS 
arises  from  two  SST  characteristics.  One  is  the  shift  in  aerodynamic  center 
with  Mach  number  as  illustrated  in  figure  3.  The  other  is  the  aft  location  of 
the  center  of  gravity  (c.g. ) for  the  operating  weight  empty  condition  due  to 
engine  locations.  These  combine  to  make  extremely  difficult  the  longitudinal 
balancing  of  the  airplane  while  avoiding  or  minimizing  (1)  the  need  for  bal- 
lasting, (2)  unproductive  portions  of  the  fuselage  that  must  be  kept  empty  of 
payload  fuel,  (3)  large  tail  areas  and  loads,  (4)  high  trim  drag,  and 
(5)  unacceptable  handling  qualities.  Some  of  the  considerations  of  the  problem 
are  described  in  reference  1. 

The  U. S.  SST  design  features  a configuration  (fig.  1)  that  is  inherently 
statically  unstable  longitudinally  (in  fact,  the  c.g.  is  aft  of  the  maneuver 
point)  at  subsonic  speeds.  An  active  flight  control  system  was  designed  to 
provide  good  handling  qualities  for  normal  operations.  This  system  was  backed 
up  by  an  HSAS  designed  to  provide  poor  but  safe  handling  qualities  with  a 
reliability  equal  to  the  airframe  structure.  In  essence,  the  HSAS  is  a pitch- 
rate  feedback  control  that  produces  an  apparent  positive  maneuver  margin.  There 
remained  a negative  static  margin  resulting  in  an  unstable  phugoid  mode;  this, 
however,  could  be  controlled  safely  by  the  pilot.  This  design  is  documented 
in  reference  1 together  with  some  design  guidelines  and  criteria.  The  flexi- 
bility of  the  airframe  was  taken  into  account.  A particularly  significant 
problem  identified  was  the  difficulty  of  providing  control  gains  that  were  high 
enough  for  rigid-body  mode  stabilization  without  destabilizing  the  lower  fre- 
quency elastic  modes. 

Source  3b  included  a preliminary  design  of  an  active  control  system  which 
consisted  of  a stability  augmentation  system  (SAS),  gust  load  alleviation,  and 
gust  acceleration  alleviation  (rigid-body  mode  acceleration)  for  ride  quality 
improvement.  The  airplane  was  eonsidered  rigid  and  the  aft-most  c.g.  location 
was  limited  to  the  neutral  point.  Thus,  the  SAS  would  not  need  to  be  hardened 
as  the  aircraft  could  be  controlled  without  it.  In  this  application  the 
benefit  stemmed  from  a reduction  in  tail  volume,  hence,  decreases  in  structural 
weight  and  in  drag.  The  procedure  used  in  the  preliminary  design  of  the  system 
of  combined  ACT  concepts  included  an  optimal  method  and  system  practicalization. 

In  Source  4b,  currently  under  way,  the  pilosophy  is  to  increase  L/D  for 
cruise  and  lift  for  landing  by  arranging  an  upload  on  the  horizontal  tail.  For 
cruise,  the  airplane  is  designed  to  be  inherently  statically  stable.  Lift  is 
increased  and  drag  is  decreased  by  means  of  a small  upload  on  the  tail,  created 
by  a suitable  wing  camber  and  twist  (Cuiq  ^ landing,  the  lifting  tail 

load  is  obtained  by  designing  the  airplane  to  be  inherently  statically  unstable; 
therefore,  an  HSAS  is  required.  Thus  an  advantage  is  taken  of  the  AC  shift  with 
Mach  number.  This  approach  is  in  general  agreement  with  that  taken  in  Source  3c. 
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In  contrast  to  results  of  some  other  relsixed  static  stability  applications, 
particularly  to  subsonic  transports,  this  approach  will  not  allow  a smaller 
tail  size  because  the  airplane  concept  features  flaps  for  take  off  and  landing 
and  the  associated  pitching  moments  size  the  tail. 


Safe  application  of  the  relaxed  static  stability 
use  of  an  angle-of-attack  limiting  system  or  a larger 
only  for  stability  in  order  to  avoid  problems  such  as 
sive  sink  rate. 


concept  will  require  the 
tail  surface  than  required 
lock-in  stall  or  an  exces- 


Center-of -Gravity  Control 

Even  with  an  HSAS,  achievement  of  a hi^ly  efficient  SST  with  good  handling 
qualities  is  difficult  due  to  the  need  to  allow  a substantial  tolerance  for 
c.g.  location.  The  benefits  of  a relaxed  static  stability  HSAS  might  be  greatly 
enhanced  if  the  c.g.  location  appropriate  to  the  particular  flight  speed  could 
be  tightly  controlled  automatically.  Source  3a  recommends  research  on  defining, 
the  requirements  for  an  onboard  c.g.  measurement  system  that  is  a prerequisite 
to  c.g.  control. 

Angle-of -Attack  (Alpha)  Limiting  System 

As  previously  mentioned  with  regard  to  the  benefits  of  relaxed  static 
stability,  an  angle-of-attack  limiter  would  enhance  the  benefits  of  an  HSAS. 

This  recommendation  is  also  made  in  Source  3a  which  points  out  the  hazard  of  a 
lack  of  warning  to  the  pilot  that  the  airplane  is  approaching  an  excessive 
angle  of  attack.  This  may  result  in  a locked-in  stall  due  to  exceeding  the 
control  authority  of  the  HSAS,  or  an  excessive  sink  rate.  Source  3a  suggests 
the  following  research:  (1)  Establish  criteria  for  longitudinal  stability  and 

control  at  the  alpha  limit;  (2)  establish  any  limitations  to  the  applications 
of  an  alpha  limiter  on  an  SST;  (3)  synthesize  a system  for  a selected  airplane; 
and  (4)  validate  the  system  by  flight  test  over  the  desired  flight  envelope. 

An  outstanding  need  is  an  alpha  sensor  that  is  accurate  and  reliable  in  an 
environment  featuring  a wide  range  of  Mach  number,  dyynamic  pressure,  and 
temperature,  and  such  hostile  agents  as  rain,  hail,  and  bird  strikes. 


Wing  Structural  Weight 

The  potential  benefits  of  maneuver  and  gust  load  alleviation,  and  flutter 
suppression  were  explored  in  Sources  3b  and  4a.  Both  sources  recognized  that 
the  several  concepts  must  be  considered  in  terms  of  their  aggregate  effects  and 
of  constraints  imposed  by  structural  requirements  for  other  than  the  controlled 
quantities.  The  need  for  this  is  discussed  with  the  aid  of  figure  4 from 
Source  4a.  This  chart  indicates  the  structural  requirements  of  the  arrow-wing 
configuration  in  terms  of  the  individual  spanwise  distributions  of  the  weight 
of  structure  necessary  for  each  of  the  items  listed  on  the  right.  These  curves 
are  conceptual,  not  calculated.  However,  the  relative  positions  of  the  flutter, 
maneuver  load,  and  gust  load  curves  are  believed  to  be  representative.  The 
extent  of  the  wing  area  for  which  some  of  these  structural  requirements  are 
dominant  for  the  baseline  arrow  wing  is  roughly  indicated  in  figure  5. 
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Flutter  requirements  are  likely  to  be  critical  for  a substantial  portion 
of  the  wing  structure*  Thus,  a potential  benefit  from  use  of  a flutter  suppres- 
sion system  is  indicated*  More  important,  however,  is  the  need  for  flutter 
suppression  in  order  to  realize  any  benefits  from  load  alleviation*  If  flutter 
is  suppressed  then  the  maneuver  load  becomes  critical,  and,  in  turn,  if  maneuver 
load  alleviation  is  effective,  the  gust  load  may  then  be  critical.  If  gust  load 
alleviation  is  effective,  the  benefits  of  a combined  flutter  suppressor,  and 
maneuver  load  and  gust  load  alleviation  system  will  ultimately  be  limited  by  the 
structural  requirements  of  other  loads,  such  as  landing,  6-g  crash,  and  fuel 
overpressure,  and  by  static  stiffness  and  minimum  gage  requirements* 

If  appreciable  reduction  of  the  structural  material  is  obtained  from  load 
alleviation,  the  burden  on  the  flutter  suppression  system  is  increased  over 
that  required  to  only  remove  the  flutter  weight  penalty  with  respect  to  the 
unalleviated  wing.  For  baseline  structures  that  are  flutter  free,  effective 
load  alleviation  may  require  flutter  suppression. 

To  summarize,  some  of  the  normally  noncritical  structural  requirements  may 
become  critical,  contingent  on  the  use  of  active  controls.  It  is  also  probable 
that  structural  requirements  not  subject  to  active  controls  will  significantly 
constrain  the  benefits  from  active  controls. 

Flutter  Suppression 

To  provide  adequate  flutter  speeds  by  conventional  techniques  for  an  arrow- 
wing airplane,  it  is  estimated  in  Source  3b  that  the  weight  of  material  added 
to  the  strength-designed  wing  is  in  the  range  of  1800  to  2700  kilograms  (4000 
to  6000  lb).  A candidate  flutter  suppression  system  was  designed  that  reduced 
this  penalty  by  about  680  kilograms  (1500  lb) . This  study  was  a relatively 
small  effort.  Presumably,  a larger  effort  might  provide  a system  of  greater 
effectiveness • 

Maneuver  Load  Alleviation 


Maneuver  load  alleviation  (MLA)  was  considered  in  Sources  3b  and  4a.  The 
results,  based  on  calculations  for  a rigid  airplane,  varied  from  5 to  9 percent 
reduction  in  wing  root  bending  moment,  depending  on  the  flight  condition  assumed 
to  be  critical.  The  estimated  attendant  reductions  in  structural  weight  ranged 
from  450  to  1010  kilograms  (1000  to  2200  lb).  These  figures  are  probably  opti- 
mistic because  the  constraints  from  other  structural  requirements,  discussed 
earlier,  were  not  imposed. 

The  effect  of  these  constraints  is  illustrated  conceptually  in  figure  6. 

If  the  requirements  for  gust  and  other  loads  and  for  minimum  gage,  etc., 
exceed  that  for  the  alleviated  maneuver  load,  only  a fraction  of  the  reduced 
weight  benefit  can  be  realized  as  indicated  by  the  shaded  area  in  figure  6.  The 
utilization  of  gust  load  alleviation  would  relax,  but  not  eliminate  these  con- 
straints. Another  constraint,  not  included  in  the  study,  is  the  effect  of 
aeroelastic  deformations  on  MLA  performance.  The  influence  of  aeroelasticlty 
on  control  surface  effectiveness  is  touched  upon  subsequently  in  this  section 
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of  the  paper,  but  the  overall  alleviation  of  loads  on  the  flexible  wing  is 
not  evaluated. 

In  assessing  benefits  of  MLA  an  adverse  side  effect  must  be  recognized. 
Effective  MLA  will  increase  the  mean  (one  g)  stress  level  over  that  of  the 
unalleviated  wing.  This  will  substantially  increase  the  fatigue  damage  rate. 

In  view  of  the  predominant  effect  of  the  ground-^air-ground  cycle  on  fatigue, 
this  may  be  a significant  additional  structural  requirement.  On  the  other  hand, 
the  MLA  concept  can  be  used  to  increase  fatigue  life  if  the  strength  require- 
ments of  the  unalleviated  airplane  are  retained. 

For  the  sake  of  generality,  it  is  of  interest  to  examine  the  properties  of 
the  control  surfaces  for  maneuver  load  alleviation.  As  can  be  observed  for 
the  arrow  wing  in  figure  7,  the  total  area  of  the  usable  control  surfaces  is 
a small  percentage  of  the  wing  area.  An  increase  in  control  surface  area  by 
increasing  the  span  of  the  control  is  precluded  by  the  space  required  by  the 
engines.  An  increase  in  control  surface  chord  is  restricted  by  the  wing  box 
structure.  It  is  likely  that  the  outboard  surfaces  1 and  2,  shown  crossed  out 
in  figure  7,  will  not  be  usable  due  to  loss  of  effectiveness  from  aeroelastic 
deformation.  The  inboard  surface  3 between  the  engines  may  also  suffer  a large 
loss  in  effectiveness  in  supersonic  flight.  However,  the  load  alleviation 
inherent  in  flexible  sweptback  wings  at  high  dynamic  pressure  reduces  the  need 
for  active  alleviation  at  supersonic  speeds.  The  need  for  MLA  is  likely  to  be 
highest  at  transonic  speeds  having  dynamic  pressures  that  are  lower  than  those 
for  cruise.  For  the  transonic  condition,  the  effect  of  aeroelasticity  on 
surfaces  3 and  4,  shown  shaded  in  figure  7,  is  not  as  severe.  These  surfaces 
were  used  in  load  alleviation  calculations  in  Source  4a. 

The  influence  of  these  small  separate  surfaces  on  the  theoretical  spanwise 
aerodynamic  load  distribution  is  shown  in  figure  8 from  Source  4a  for  the  arrow 
wing.  These  results  were  obtained  using  Woodward  aerodynamics  for  a M = 1.2, 
lightweight  condition,  assuming  a rigid  structure  and  maximum  control  surface 
deflections  of  20°.  The  reduction  in  net  (aerodynamic  and  inertia)  bending 
moment  can  be  shown  to  be  about  5 percent  at  the  root  and  about  9 percent  at 
the  mid-semispan  station. 

Although  only  effects  on  bending  moment  were  examined,  the  additional 
chordwise  loads  accompanying  the  control  surface  deflections  may  be  significant. 
Also  significant  may  be  the  differences  between  theoretical  and  actual  loads  at 
limit  load  levels  due  to  nonlinear  aerodynainic  phenomenon  such  as  flow  separa- 
tion on  control  surfaces  and  pressure  limiting. 

Gust  Load  Alleviation 

Gust  load  alleviation  (GLA)  was  considered  in  Sources  3b  and  4a.  GLA  is 
defined  herein  as  the  reduction  of  the  rigid-body -mode  gust  load  responses. 

The  load  increments  from  vibration  of  structural  modes  are  not  accounted  for. 

It  is  assumed  that  these  would  be  controlled  by  a mode  suppression  system  which 
is  mentioned  under  the  subject  of  ride  quality  control.  The  results  for  a rigid 
airplane  in  terms  of  structural  weight  reduction,  assuming  no  constraints  from 
other  structural  requirements,  varied  from  zero  to  about  225  kilograms  (50G  lb) 
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As  in  the  case  of  maneuver  load  alleviation,  these  constraints  may  reduce  the 
higher  value  cited.  The  magnitude  of  benefits  can  vary  depending  on  bookkeeping 
methods.  If  GLA  is  needed  to  realize  the  benefits  of  MLA  then  the  scmiewhat 
greater  benefit  of  MLA  may  be  attributed  to  GLA  as  well. 

The  reason  for  the  small  benefits  of  GLA  to  the  arrow-wing  configuration 
is  that  the  airpalne  is  somewhat  less  sensitive  to  gusts  than  subsonic  jets., 

The  gust  load  factor  for  the  arrow-wing  airplane  was  estimated  in  Source  4a  to 
be  about  2.0g  in  contrast  to  the  2.5g  maneuver  limit  load  factor.  At  first 
glance,  this  seemed  surprising  in  view  of  the  low  wing  loading  (lowest  value  is 
approximately  1900  newtons /meter^  (40  Ib/sq  ft).  However,  the  low  wing  loading 
is  compensated  for  by  the  characteristically  low  value  of  lift  curve  slope  for 
highly  swept,  low-aspect -ratio  wings . 

For  reasons  given  in  the  discussion  of  MLA,  the  available  control  surfaces 
for  GLA  are  the  two  inboard  surfaces.  It  is  of  interest  to  note  that  the  sense 
of  the  deflection  of  these  inboard  surfaces  for  GLA  is  opposite  to  that  for  MLA. 
For  example,  for  the  alleviation  of  a positive  maneuver  load  the  trailing  edges 
of  the  controls  should  deflect  downward,  whereas  for  the  alleviation  of  a 
positive  gust  load  the  trailing  edges  should  deflect  upward.  For  outboard 
control  surfaces,  were  they  effective,  the  sensq  of  the  deflection  for  MLA 
and  GLA  would  be  the  same. 


Ride  Quality 


The  unpleasant  accelerations  during  flight  in  turbulence  can  be  regarded 
as  arising  from  two  sources;  (1)  the  response  of  the  airplane  rigid-body  modes 
and  (2)  the  vibratory  response  of  the  elastic  modes.  These  are  illustrated 
schematically  in  figure  9.  The  total  vertical  accleratlon  response  is  shown 
by  the  sketch  at  the  top  and  consists  of  the  sum  of  high  frequency  structural 
oscillations  and  lower  frequency  rigid-body-mode  responses.  The  use  of  mode 
suppression  by  means  of  small  canards  or  other  auxiliary  control  surfaces  to 
reduce  the  structural  vibration  may  be  necessary  as  suggested  by  the  flight 
experience  with  the  XB-70  airplane  and  by  Source  3b.  (Source  3b  indicates  that 
need  is  marginal.)  Effective  mode  suppression  would  then  leave  the  rigid-body- 
mode  acceleration  as  indicated  by  the  middle  sketches  in  figure  9.  The  rigid- 
body-mode  accelerations  can  be  controlled  by  gust  acceleration  alleviation. 
However,  for  the  SST  these  lower  frequency  responses  are  not  likely  to  be 
objectionable  on  the  basis  of  gust  sensitivity  estimates  in  Sources  3b  and  4a. 


The  gust  sensitivity. 


0.01 


(ratio  of  root-mean-square  values  of 


acceleration  and  gust  velocity)  for  the  rigid-body  modes  is  well  below  values 
for  subsonic  jet  transports.  It  is  just  as  well,  for  the  effectiveness  of  the 
available  control  surfaces  to  alter  the  wing  lift  for  the  reduction  of  low 
frequency  gust  accelerations,  indicated  by  the  bottom  sketch  in  figure  9,  is 
low. 


In  general,  effective  use  of  maneuver  and  gust  load  alleviation  (of  loads 
from  rigid-body-mode  responses)  will  tend  to  Increase  the  severity  of  structural 
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vibrations  over  that  of  the  unalleviated  wing  and,  therefore,  increase  the  need 
for  mode  suppression.  Incidentally,  the  mode  suppression  may  provide  a degree 
of  flutter  suppression  and  vice  versa.  It  could  be  advantageous  to  combine  the 
two  concepts. 


Other 

Although  they  are  not  found  in  most  lists  of  active  control  systems,  there 
are  two  other  concepts  that  may  benefit  an  SST, 

One  is  the  concept  of  automatically  controlling  the  airplane  lateral 
transient  accompanying  an  engine  unstart  at  supersonic  speeds.  Conceivably, 
following  an  unstart  the  airplane  could  be  disturbed  so  rapidly  that  the  pilot 
could  not  apply  corrective  action  before  the  vehicle  exceeded  design  loads  or 
a controllable  angle  of  attack  or  sidelsip.  The  second  concept  is  an  actively 
controlled  landing  strut  to  reduce  the  loads  and  unpleasant  motions  of  the 
elongated  SST  during  taxi  runs.  Research  on  this  concept  is  being  conducted 
at  the  Langley  Research  Center. 


CONCLUDING  REMARKS 


The  information  surveyed  indicates  that  some  significant  benefits  to  SST 
designs  may  be  obtained  through  active  controls.  There  is  considerable  agree- 
ment that  a large  transport  will  require  active  stabilization  of  an  inherently 
statically  unstable  condition  at  subsonic  speeds.  The  benefit  of  the  relaxed 
static  stability  may  be  increased  by  use  of  center-of -gravity  control  and 
angle-of-attack  limiting.  Benefits  from  maneuver  and  gust  load  alleviation  may 
be  small  for  the  arrow-wing  concept.  In  any  case,  load  alleviation  most  likely 
will  require  that  flutter  suppression  be  used  as  well.  Flutter  suppression  in 
itself  may  provide  some  saving  in  structural  weight.  Ride  quality  control  by  a 
mode  suppression  system  may  be  needed  for  passenger  acceptance.  For  safety, 
active  lateral  control  should  be  considered  for  limiting  the  magnitude  of  the 
transient  motion  due  to  an  engine  unstart. 
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Figure  4*-  Wing  structural  requirements  of  baseline  arrow-wing  airplane. 
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Figure  6 i-  Structural  requirement  constraint  for  maneuver  load 

alleviation. 
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Figure  8.-  Spanwise  aerodynamic  load  distributions  at  limit  load 
Mach  number  1.2,  control  deflection  20^. 


TURBULENCE  WITHOUT  ACTIVE  CONTROL  VERTICAL  ACCELERATION 
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ESTABLISHING  CONFIDENCE  IN  CCV/ACT  TECHNOLOGY 


Richard  B . Holloway  and  Henry  A . Shomber 
The  Boeing  Company 


SUMMARY 


Despite  significant  advancements  in  Controls  Configured  Vehicles/Active 
Controls  Technology  (GCV/aCT)  in  the  past  decade,  few  applications  of  this 
promising  technology  have  appeared  in  recent  aircraft  designs#  This  paper 
briefly  summarizes  the  status  of  CCV/aCT,  describes  some  of  the  constraints 
■which  are  retarding  its  "wider  application,  and  offers  some  suggestions  toward 
establishing  an  increased  level  of  confidence  in  the  technology. 


IKERODUCTION 


Major  advancements  have  been  accomplished  in  flight  control  technology 
during  the  past  decade,  particularly  in  the  areas  of  fly-by-wire,  active 
controls  and,  more  recently,  digital  controls.  The  next  generation  of  U.  S. 
commercial  transports  must  take  advantage  of  benefits  achievable  from  these 
advanced  techniques  to  remain  competitive  in  the  world  market.  European 
aircraft  industries  have  major  advanced  flight  control  programs  underway 
and  are  making  significant  progress  in  this  field.  The  United  States  space 
program,  research  aircraft  programs  and  military  advanced  development  programs 
have  brought  ACT  digital  EB¥  (fly-by-wire)  technology  to  a level  where 
substantial  benefits  can  be  realized  in  the  near  future.  However,  the 
commercial  aircraft  industry,  airline  industry,  and  government  civil  aviation 
agencies  must  be  convinced  that  an  aircraft  designed  around  this  advanced 
technology  will  achieve  predicted  performance  and  be  safe,  reliable, 
operationally  practical  and  cost  effective.  Commercial  acceptance  of  any  new 
technology  will  occur  only  when  sufficient  test  data  are  generated  to  clearly 
demonstrate  that  these  criteria  can  be  met  with  reasonable  risk  on  a new 
airplane  design. 

Most  of  the  progress  to  date  in  this  field  has  been  aGcomplished 
primarily  on  four  aircraft:  the  XB-TO,  B-52,  F-4  and  P-8.  Programs  on 

these  aircraft  are  making  significant  necessary  contributions,  but  the 
programs  are  experimental  in  nature,  conducted  to  demonstrate  concept 
feasibility  under  carefully  restricted  flight  conditions  in  evacuable  military 
aircraft  with  ejection  seats.  This  paper  briefly  summarizes  the  state-of- 
the-art  of  CCV/aCT  technology  and  suggests  some  approaches  to  the  problem  of 
developing  a wider  level  of  confidence  in  that  technology. 


paoe  blahe^  hot  nuiBift 
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BACKGROUm) 


In  the  past  decade,  potential  benefits  of  advanced  flight  control 
technology  have  been  shown  by  a large  nuinber  of  theoretical  analyses  and  by 
several  USAF  and/or  NASA  flight  demonstration  programs.  Table  I summarizes 
briefly  the  results  of  most  of  these  efforts.  References  1 and  2 provide 
a more  complete  summary. 

Major  Air  Force  experimental  flight  research  programs  involving  load 
alleviation  and  fatigue  damage  rate  reduction  by  structural  mode  control 
techniques  were  the  B-5S  LAMS  (Load  Alleviation  and  Mode  Stabilization)  and 
the  XB-70  GASDSAS  (Gust  Alleviation  and  Structural  Dynamic  Stability 
Augmentation  System)  programs.  Concurrently,  an  advanced  stability  augmentation 
system  (SAS)  was  developed  and  incorporated  on  the  B-52G  and  H fleet  to 
reduce  fatigue  damage  rate  during  low  level,  high  speed  flight.  The  Air 
Force  Control  Configured  Vehicle  (CCV)  research  program  has  completed  flight 
deraonstration  of  four  ACT  concepts  at  selected  flight  conditions  on  a B-52E 
aircraft:  ride  control,  flutter  mode  control,  maneuver  load  control,  and 

augmented  stability.  In  addition,  the  compatibility  of  a LAMS  system  with 
these  four  concepts  was  also  demonstrated-.  Goals  for  each  concept  were 
successfully  achieved  individually  and  collectively  during  the  program. 

Other  flight  programs  have  incorporated  limited  ACT  concepts  in  recently 
designed  military  and  commercial  aircraft.  Reduction  of  lateral  gust  loads 
on  the  L-1011  transport  with  an  advanced  yaw  damper  resulted  in  a 20  percent 
reduction  of  limit  design  loads.  A Gust  Response  Suppression  System  has 
been  developed  for  the  7^7  to  improve  passenger  ride  qualities  in  the  aft 
section.  The  system  is  currently  being  evaluated  by  Qantas  Airways.  A ride 
control  system  is  being  designed  for  the  B-1  strategic  bomber,  using  structural 
mode  control  techniques,  to  improve  crew  ride  qualities  during  terrain  following 
missions.  An  Active  Lift  Distribution  Control  System  (ALDCS)  is  being  designed 
for  the  C“5A  airplane  to  reduce  wing  design  limit  maneuver  and  gust  loads 
and  wing  fatigue  damage  rate.  The  General  Dynamics  prototype  lightweight 
fighter,  the  YF-I6,  has  a quadruply-redundant  analog,  FB¥  control  system 
without  mechanical  backup.  Relaxed  inherent  stability  is  integrated  into  the 
aircraft  design  to  reduce  drag  and  gross  weight. 

The  first  serious  commitment  to  including  an  ACT  concept  in  a commercial 
transport  occurred  during  the  recent  National  SST  program.  The  SST  was 
configured  with  relaxed  longitudinal  static  stability  to  achieve  necessary 
gains  in  range-payload  from  reduced  gross  weight  and  drag.  Experience  gained 
from  development  of  fail-passive  and  fail-operational/fail-passive  autoland 
systems  at  Boeing  during  the  1960's  provided  confidence  that  a suitable  flight 
control  system  could  be  developed  to  meet  SST  safety  and  operational  requirement 

The  resulting  SST  longitudinal  command  and  stability  augmentation  system 
providing  basic  airplane  safety  was  fail-operational  squared  (fail-operate 
after  second  failure),  utilizing  quadruply  redundant  sensors,  analog  electronic 
channels  and  actuators.  A mechanical  reversion  back-up  mode  was  retained 
(a  discussion  of  this  system  is  contained  in  Reference  3)* 
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Cancellation  of  the  SST  program  precluded  thorough  development  and  flight 
test  evaluation  of  the  SST  flight  control  system.  Advanced  technology  items 
which  include  electronic  display  and  control  system  components  were,  however, 
government  funded  for  further  development  under  the  DOT/sST  Technology  follow- 
on  program  (Contract  DOT-PA72-IA-2893) . 

Pull  realization  of  advanced  control  function  potential  on  production  air- 
craft depends  on  fly-hy-wire  control  systems  with  a reliability  consistent 
with  the  function  criticality.  Two  programs,  the  Air  Porce  P-4  68OJ 
Survivable  Plight  Control  System  and  the  NASA  P-8C  digital  fly-by-wire 
program,  are  directed  toward  developing  and  flight  demonstrating  PB¥  systems 
on  fighter  aircraft.  As  a result,  Eeference  4 states  that  '’with  successful 
completion  of  the  68OJ  flight  test  program,  analog  fly-by-wire  control 
techniques,  equipment  mechanization  and  fundamental  criteria  are  now  fully 
validated". 

Most  advanced  PBW  flight  control  systems  have  used  analog  Implementation 
techniques.  Research  is  now  underway  to  exploit  the  advantages  of  digital 
control,  deraonstrated,  in  part,  by  the  Apollo  space  program.  The  recent 
extremely  rapid  progress  in  microcircuitry  has  made  digital  control  hardware 
competitive  with  analog  hardware  in  terms  of  cost,  reliability,  size  and 
weight.  Purther,  digital  techniques  offer  significant  advantages  for 
advanced  control  laws,  redundancy  logic  and  built-in  testing  functions.  One 
of  the  first  programs  to  study  digital  flight  control  implementation  problems 
on  aircraft  is  the  NASA  P-8  program  which  successfully  demonstrated  a single 
channel  digital  PB¥  primary  flight  control  system  with  a triply  redundant 
analog  backup  system.  Other  digital  control  research  programs,  such  as  the 
Digital  Avionics  Integrated  Systems  (DAIS),  the  SST  Pollow-On  Technology,  ani 
the  planned  Tactical  Aircraft  Digital  System  (TADS),  are  contributing  to  this 
technology  base.  Other  Air  Porce  programs  are  investigating  the  application 
of  multiplexing  techniques  to  flight  control  systems.  Purther,  research 
efforts  within  the  U.  S.  and  European  flight  control,,  system  component 
manufacturers  are  studying  fiber  optics  for  providing  signal  transmissions 
immune  to  electromagnetic  interference. 

An  overall  assessment  of  advanced  flight  control  technology  over  the 
past  decade  indicates  that  eonsiderable  progress  has  been  achieved: 

o Performance  of  CCV  functions  has  been  flight  demonstrated  on  a 
large  flexible  aircraft 

o Digital  and  analog  PB¥  systems  have  been  flight  demonstrated  on 
fighter  aircraft 

o A prototype  lightweight  fighter  has  been  designed  around  CCV 
analog  PB¥  techniques. 
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CONSTRAHilTS  OH  THE  USE  OF  CCV/ACT  TECHNOLOGY 


Despite  the  large  amount  of  analytieal  and  flight  test  data  available, 
no  GCV/aCT  concepts  are  currently  in  general  use  in  commercial  transport 
aircraft.  Only  the  simplest  form  of  augmented  stability-- the  yaw  damper-- 
is  in  widespread  use  in  commercial  aircraft  today.  Primry  applications  are 
to  improve  handling  qualities  and  to  increase  the  comfort  level  of  the  crew 
and  passengers.  In  a few  instances,  a yaw  dan^jer  was  necessary  for 
certification.  Although  these  are  exan^les  of  beneficial  applications,  the 
systems  were  generally  added  after  the  airplane  was  designed,  sometimes 
after  the  first  model  flew.  In  most  instances,  a much  greater  benefit 
would  have  been  possible  if  a full-time  directional  stability  augmentation 
system  had  been  assumed  from  the  beginning  of  the  design. 

There  are  a number  of  constraints  that  have  effectively  delayed  the  wide- 
spread implementation  of  these  systems.  A most  fundamental  constraint  is 
risk,,  principally  on  the  part  of  the  airframe  manufacturer.  As  has  been 
pointed  out,  the  maximum  potential  benefit  of  these  advanced  concepts  is 
achieved  if  they  are  incorporated  into  the  design  at  the  outset.  However, 
the  final  assessment  of  the  benefit  results  from  an  exhaustive  design  process 
that  is  expensive  and  time  consuming,  and  for  which  the  ccsrrelation  with 
hardware  results  is  not  at  all  certain.  The  real  risk  is  that  a major  problem 
may  arise  after  program  ccamnitment  of  an  airplane  design  predicated  on 
successful  system  performance. 

Figure  1,  reproduced  from  Reference  hS,  illustrates  this  concern.  At 
program  go-ahead,  with  only  3^  of  the  eventual  total  program  cost  actually 
spent,  management  action  can  influence  total  program  cost  by  20^  at  most. 
Consequently,  a program  that  relies  on  advanced  systems  will  either  require 
a significant  increase  in  analysis  confidence,  or  a program  structure  like 
the  U.  S.  SST  where  an  engineering  prototype  precedes  production  commilanent. 

In  other  words,  one  way  of  eliminating  the  risk  is  to  have  a "proof  before 
use"  program  plan,  which  adds  to  program  time  and  cost. 

Another  constraint  is  the  cost  of  these  systems,  including  development, 
certification,  and  maintenance  cost.  Bright  spots  in  the  cost  picture  are 
the  rapidly  developing  field  of  digital  systems  for  aircraft  applications  and 
the  reductions  in  analog/digital  system  cost  disparity. 

A third  constraint  is  the  lack  of  confidence  in  the  analysis  tools  and 
the  correlation  between  analytieal  models  and  the  real  world.  For  example, 
if  a new  airplane  were  to  depend  on  flutter  mode  control  for  flutter  safety, 
there  would  be  little  margin  for  error  between  the  analytical  model  and  the 
hardware.  Yet  the  state  of  the  art  of  flutter  analysis  can  accomplish  this 
today  iOnly  by  "fine  tuning"  the  analysis  with  hardware  data . 
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A final  constraint  is  the  reluctance  on  the  part  of  the  user,  the  airlines, 
to  increase  maintenance  costs.  Consequently,  there  is  great  reluctance  to  buy 
a system,  almost  independent  of  its  performance  benefits,  unless  there  is  a 
proven  method  of  keeping  the  maintenance  burden  in  hand. 

It  is  generally  true  that  maintenance  constitutes  about  one-quarter  of 
the  total  direct  operating  costs  for  current  airplanes.  Therefore,  complexity 
such  as  discussed  here  should  be  accompanied  by  systems  designed  to  hold  the 
line  on,  or  lower,  maintenance  costs.  Digital  systems,  with  improved  self- 
check  capability,  may  provide  a solution  to  this  problem. 


REMOVING  THE  CONSTRAINTS:  DEVELOPING  CONFIDENCE 


Commercial  realization  of  the  benefits  associated  with  advanced  control 
concepts  will  occur  only  when  these  constraints  are  removed  through  compre- 
hensive development  and  demonstration  of  necessary  methods  and  components. 


Plight  Demonstration 


Most  of  the  progress  to  date  in  this  field  has  been  accomplished  primarily 
on  four  aircraft:  the  B-52,  P-4,  P-8  and  XB-70.  Programs  involving  the 

military  aircraft  are  making  significant  necessary  contributions,  but  the 
programs  are  experimental  in  nature,  conducted  to  demonstrate  concept 
feasibility  under  carefully  restricted  flight  conditions  in  evacuable  aircraft 
with  ejection  seats. 

The  next  logical  program  should  expand  this  technology  base  by  developing 
and  flight  demonstrating  an  operationally  practical  advanced  digital  fly-by- 
wire  control  system  on  a commercial  aircraft.  The  system  should  be  designed 
to  function  throughout  the  flight  envelope,  from  takeoff  to  landing,  under 
normal  and  extreme  operating  conditions.  It  should  include  appropriate 
redundancy  management,  automated  system  test,  system  control,  and  system  status 
and  advisory  displays.  Extensive  flight  testing  must  be  conducted  to  define 
system  performance  (compared  to  analytical  predictions),  reliability,  failure 
effects,  and  maintainability  requirements  under  conditions  representative 
of  commercial  airline  operation.  Realistic  design  criteria  and  design  guide- 
lines should  be  developed,  based  on  results  of  the  program,  for  critical  and 
noncritical  control  functions.  This  program  should  also  be  responsive  to 
technology  recanmendations  expressed  in  the  NASA  Research  and  Technology 
Advisory  Council  report  (Reference  4-T ) . 

A flight  demonstration  program  formulated  to  satisfy  these  objectives 
and  requirements  could  best  achieve  credible  test  results  by  utilizing  a 
current  state-of-the-art,  operational,  commercial  aircraft  as  the  test  vehicle. 
The  NASA  RSPS  airplane  is  well  qualified  as  a test  vehicle  for  demonstrating 
certain  elements  of  an  advanced  control  system.  This  aircraft  is  currently 
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Tseing  converted  into  a canmercial-type  research  vehicle  under  Department  of 
Transportation  SST  Technology  Follow-Gn  Program  and  NASA  Research  Support 
Flight  System  contracts  (References  55  56)  . Arrangement  of  the  new 

experimental  flight  control,  navigation,  and  display  equipment  being  installed 
for  the  RSFS  is  shown  in  the  cutaway  view  of  Figure  2.  The  aircraft  features 
an  aft  flight  deck  (AFD)  from  which  a two-man  crew  may  fly  the  airplane  from 
takeoff  to  landing  with  controls  electrically  coupled  to  the  standard  737 
flight  control  system.  Advanced  electronic  systems  include  triply  redundant 
digital  automatic  flight  control  computers  and  an  advanced  digital  navigation, 
guidance,  and  display  system.  A data  acquisition  system  provides  experimental 
data  for  postflight  analyses.  The  complete  system  (sensor  to  control  surface 
output),  which  has  an  electronic  fail-operative  capability,  is  limited  to  a 
single  thread  actuation  capability. 

The  current  and  planned  use  of  the  aircraft  is  for  extensive  NASA  research 
programs  regarding  flight  in  the  terminal  area.  The  experience  obtained  during 
these  programs  in  the  operation  and  performance  of  the  fail-operational  sensor 
and  computer  system  will  be  directly  applicable  to  advanced  control  system 
development. 

The  aircraft,  as  currently  configured.,  has  the  capability  to  provide 
meaningful  performance,  reliability,  and  maintainability  test  data  in  a 
limited-cost  flight  program.  The  aircraft  could  also  be  modified  to  provide 
sufficient  system  redundancy  and  capability  to  more  completely  model,  and 
thereby  provide  better  data  on,  the  performance  benefits,  reliability,  and 
maintainability  of  these  systems.  This  possibility  is  being  explored  by 
Boeing -Wichita  under  contract  to  NASA-Langley. 


Redundancy  Management 


The  redundancy  required  for  a flight-critical  control  system  depends  to 
a great  extent  on  the  mechanization  scheme  adopted,  as  well  as  the  failure 
characteristies  of  the  system  under  consideration.  Similar  considerations 
apply  whether  the  element  is  a mechanical  actuator  or  an  electronic  element. 
DOT-sponsored  research  (References  53  and  5^)  examined  the  elements  of  the 
U.  S.  SST  prototype  control  system  and  identified  problem  areas  associated 
with  the  redundancy  of  those  systems,  e.g.,  channel  Interactions,  failure 
detection,  and  failure  effects  on  system  performance.  A NASA- sponsored 
study  (Reference  27)  reviewed  ten  current  actuator  redundancy  mechanization 
schemes  and  identified  two  concepts  that  would  meet  advanced  airplane  flight 
control  system  requirements. 

These  results  are  cited  as  evidence  that  work  is  proceeding  in  this 
area.  ' But  it  must  be  pointed  out  that  since  con^iutation  and  actuation  are 
key  elements  of  any  control  system,  the  promise  of  advanced  controls  will  not 
be  realized  until  the  technology  for  providing  adequate  reliability  with 
reasonable  system  cost  is  In  hand.  Appropriate  research  must  be  carried  out 
in  this  area  of  redundancy  management  to  ensure  that  the  design  capability  is 
available  when  needed . 
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Improved  Analysis  Techniques 


acisting  methods  cannot  provide  the  technological  "base  for  the  design 
of  airplane  configurations  that  rely  on  a control  system  for  structural 
design  load  reduction,  flutter  envelope  expansion,  or  stability  when  balanced 
for  Optimum  performance.  Some  of  the  more  fundamental  problem  areas  are; 
transonic,  nonlinear,  and  unsteady  aerodynamics;  interaction  of  structural 
deformation  and  control  surface  deflections  with  aerodynamic  loading;  and  the 
dynamics  of  large  flexible  structures.  Reference  points  out  that  these 
problems  "have  been  painfully  evident  to  aeroelasticians  for  at  least  three 
decades.” 

Current  analytical  capability  must  be  expanded  to  provide  adequate 
treatment  of  these  problem  areas.  Analytical  methods  for  the  rapid  incor- 
poration of  experimental  data  into  the  analyses  should  be  pursued  with  the 
objective  of  successfully  treating  separated  flow  regions  and  nonlinearities 
due  to  discontinuities.  The  methods  resulting  fron  this  work  should  be 
verified  through  correlation  with  wind  tunnel  and  flight  test  data.  A few 
tentative  steps  are  being  taken  in  this  direction,  but  much  additional  work 
remains. 

In  the  past,  wind-tunnel  testing  of  dynamically  scaled  airplane  models 
has  proven  economically  desirable  to  predict  airplane  dynamic  characteristics 
prior  to  flight  testing.  As  aircraft  become  more  dependent  on  stability 
augmentation  systems,  wind-tunnel  testing  of  aeroelastic  models  to  prove 
control  concepts  will  become  increasingly  more  attractive  to  increase 
confidence  in  analyses,  as  discussed  In  Reference  48. 

In  1967^  AFFDL  and  KASA-Langley  jointly  initiated  a program  to  demonstrate 
an  active  modal  suppression  system  on  a one-thirtieth  scale  B-52E  aeroelastic 
model  in  the  Langley  transonic  dynamics  tunnel.  This  model  includes  aileron 
and  elevator  actuation  systems  and  provisions  for  a cable  mount  system 
(Reference  49) . Model  gust  responses  have  been  obtained  using  the  airstream 
oscillator  system  installed  in  the  tunnel , (Reference  50)-  Boeing-Wichita  is 
assisting  HASA  in  developing  a ride  smoothing  system  for  the  model  using  50  Hz 
bandwidth  aileron  and  elevator  actuation  systems.  Subsequently,  canards  and 
flaperons  were  added  for  RC  and  IMG  testing,  which  is  now  nearing  completion. 

In  1974  a MLC  system  will  be  tested. 

In  addition,  wind  tunnel  tests  have  been  conducted  at  NASA-Langley  on  a 
SST  wing  model  which  utilizes  a IMG  system  (References  5I  and  52).  Wider 
use  of  such  models  will  be  of  great  benefit  in  GGV  system  synthesis  and  test. 

Results  of  the  recently  completed  B-52  GGV  program  indicate  that  precise 
mathematical  models  may  not  be  quite  as  vital  as  stated  above.  Inaccuracies 
in  the  math  model  may  be  made  tolerable  by  intelligent  location  of  force 
producers,  and  use  of  motion  sensors  located  at  several  different  points 
in  the  structure  to  be  controlled  (Reference  57)* 
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CONCLUDING  REMARKS 


Within  the  past  decade  a great  amount  of  work  has  heen  performed  to 
demonstrate  benefits  of  active  controls  technology,  yet  today  applications 
of  this  technology  are  few.  The  best  way  to  develop  confidence  in  these 
concepts  is  to  flight  demonstrate  the  concepts  on  a commercial  transport 
under  normal  and  extreme  operating  conditions.  Such  a program  will  clearly 
demonstrate  and  establish  confidence  in  CCV/ACT  technology. 
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TABLE  I 
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INTRODUCTION 


The  question  of  design  criteria  for  active  control  transports  is  one  of 
the  key  issues  involved  in  the  design.  The  reason  for  this  is  that  if  one  is 
to  realize  benefits  in  the  form  of  increased  range,  decreased  weight,  etc. , 
he  must  be  able  to  apply  design  criteria  which  take  into  consideration  the 
design  improvements  afforded  by  active  controls.  The  work  presented  in  this 
paper  draws  heavily  from  the  report  of  an  industry  panel  sponsored  by  NASA  in 
1972-73  to  study  vehicle  design  considerations  for  active  control  applications 
to  subsonic  transports.  This  work  is  soon  to  be  published  in  a NASA  document, 
reference  1.  Additional  background  material  has  been  drawn  from  references  2 
through  16,  which  are  not  cited  Individually.  In  this  paper  today  we  will 
define  what  is  meant  by  active  control  and  then  define  those  functions  wnich 
were  considered  by  this  panel  and  should  be  considered  in  any  detailed  study 
of  design  criteria.  We  will  also  touch  briefly  on  the  FAA  regulations 
governing  transport  aircraft  design. 


ACTIVE  CONTROL  TECHNOLOGY 

A 


The  question  of  just  what  kind  of  an  airplane  configuration  satisfies  the 
definition  of  an  active  control  aircraft  is  difficult.  Several  designations 
for  this  type  of  aircraft  have  been  used  (fly  by  wire,  CCV,  etc.)  but  an  air- 
craft utilizing  active  controls  can,  in  general,  be  identified  as  one  in  which 
significant  inputs  (over  and  above  those  of  the  pilot)  are  transmitted  to  the 
control  surfaces  for  the  purpose  of  augmenting  vehicle  performance.  These 
inputs,  derived  from  various  sensors  and  properly  processed,  can  be  utilized 
to  provide  reduced  trim  drag  and  tail  area  through  stability  augmentation, 
reduce  structural  fatigue,  alleviate  maneuvering  loads,  suppress  flutter,  and 
improve  ride  comfort.  If  applied  in  a meaningful  manner  early  in  the  vehicle 
design,  ACT  can  have  a significant  impact  on  vehicle  weight  and  geometry,  thus 
leading  to  the  designation  of  a ’Control  configured  vehicle*’  (CCV)  . 

The  term  **fly  by  wire"  describes  a method  of  system  implementation  whereby 
electrical  connaands  are  used.  This  approach  is  suited  to  the  application  of 
active  controls  in  that  it  provides  an  ideal  interface  between  the  basic 
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command  system  and  the  sensor  and  signal  processing  elements. 

One  frequently  reads  in  the  literature  items  which  would  lead  one  to 
believe  that  the  active  control  transport  will  be  a sudden  and  rather  drastic 
innovation  from  the  long  line  of  transport  development  over  the  last  40  years. 
As  a matter  of  fact,  it  is  not  a sudden  transition,  but  a continuing  growth  in 
the  technology  of  transport  aircraft  design.  Every  modem  day  aircraft,  to 
some  extent,  incorporates  some  of  those  functions  which  we  rather  loosely  tie 
together  under  the  name  of  active  control  technology.  It  became  apparent  in 
the  early  twin  engine  transports  that  the  pilot  had  difficulty  exerting 
sufficient  stick  force  to  move  the  control  surfaces  of  the  aircraft.  The 
designers  rather  ingeniously  provided  the  pilot  with  aerod3niamic  tabs  in 
order  to  reduce  his  workload  and  make  the  aircraft  easier  to  control.  Asrair- 
craft  continued  to  grow,  hydraulic-^powered  control  systems  were  implemented. 
Although  these  early  systems  were  designed  in  a manner  which  still  provided 
the  pilot  with  a mechanical  linkage  to  the  surface  in  the  event  of  hydraulic 
failure,  the  modem  day  transports  (the  DG-10,  LlOll,  the  747)  now  completely 
depend  on  the  hydraulic  system,  and  the  designer  (and  the  pilot)  must  rely  on 
the  reliability  of  the  redundant  systems  which  supply  the  power  for  the 
control  surfaces. 


Along  with  this  reliance  on  hydraulic  systems,  the  pilot  has  also 
experienced  an  increase  in  cockpit  workload  from  the  many  other  systems  which 
must  function  properly  for  the  economical  and  safe  operation  of  the  large 
transport  aircraft.  In  return,  flying  qualities  and  comfort  have  improved, 
reducing  pilot  effort  and  fatigue.  The  pilots  are  slowly  learning  to  accept 
the  fact  that  certain  critical  conditions  must  be  automatically  detected  and 
appropriate  remedial  action  taken  without  pilot  activity.  In  this  context 
then,  the  incorporation  of  further  active  controls  on  the  transport  aircraft 
is  not  a sudden  transition  but  a steady  progression  toward  a more  modem  and 
efficient  transport  design. 

Design  criteria  and  FAA  safety  regulations  have  generally  responded  to 
design  innovations  such  as  active  control  rather  than  leading  these  technical 
advances.  It  is  important  at  this  time,  with  active  controls  of  various  kinds 
becoming  more  and  more  common,  that  design  criteria  and  Federal  safety 
regulations  lead  the  effort  rather  than  follow  these  new  designs.  The  panel 
concluded  that  most  of  the  immediately  available  active  control  techniques 
have  been  well  explored  theoretically  and,  in  fact,  have  been  and  are  being 
demonstrated  each  day  on  a wide  variety  of  experimental  and  military  aircraft. 
This  demonstration  program  is  illustrated  in  Table  1. 

The  important  conclusion  to  be  drawn  from  this  table  is  that  when  dis- 
cussing active  control  technology,  one  is  dealing  with  a technology  which  in 
some  cases  is  well  advanced,  including  operational  experience  on  transport 
aircraft.  Certainly  if  one  compares  this,  say  for  instance,  to  the 
introduction  of  jet  engines  on  aircraft,  one  would  be  forced  to  the  conclusion 
that  the  relative  state  of  readiness  of  active  controls  approaches  that  of  jet 
engines  at  the  time  they  were  introduced  into  commercial  aircraft.  It  is  also 
important  to  note,  however,  the  disparity  between  the  status  of  various 
functions.  For  instance,  the  yaw  damper  is  well  received  and  in  fact  may  be 
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mandatory  for  safe  handling  qualities,  and  has  many  thousands  of  transport 
flight  hours  behind  it.  On  the  other  hand,  flutter  control  is  by  comparison 
only  in  its  infancy.  This  leads  to  the  conclusion  that  we  must  approach 
active  control  technology  not  as  an  all--incluslve  blanket  addition  to  an  air- 
craft, but  in  a step  by  step  procedure  with  each  new  subsystem  being  carefully 
verified  on  the  basis  of  cost  effectiveness,  need,  and  reliability. 

The  above  table  does  not  consider  the  experience  gained  in  the  many 
missiles  and  spacecraft,  both  manned  and  unmanned,  which  have  flown  with 
complete  automatic  control  and  hands-off  operation.  Every  Apollo  mission  from 
launch  to  splashdown  is  a demonstration  of  active  control  technology.  The 
rapidly  increasing  technology  of  remotely  piloted  vehicles  is  also  quickly 
adding  to  the  storehouse  of  knowledge  on  how  to  take  off,  land,  and  navigate 
in  a hands-off,  completely  automatic  mode.  Indeed,  one  must  consider  that 
more  than  25  years  ago  the  first  hands-off  flight  of  an  aircraft  was 
demonstrated  from  takeoff  to  landing. 


ACTIVE  CONTROL  FUNCTIONS 


Relaxed  Inherent  Stability 

Relaxed  inherent  stability  is  conventionally  defined  as  a reduction  in 
the  stability  of  the  short-period  attitude  modes  of  rigid -body  aircraft  motion. 
That  is,  reductions  in  inherent  stability  result  from  the  reduction  of  aerody- 
namic restoring  moment  with  respect  to  angle  of  attack  or  angle  of  sideslip  or 
a reduction  of  aerodynamic  damping  for  the  unaugmented  (basic)  aircraft.  In 
principle,  relaxed  inherent  stability  can  also  refer  to  reduction  in  stability 
for  other  modes  of  aircraft  motion. 

This  is  a very  important  departure  because  the  basic  stability  parameters 
in  both  the  pitch  and  yaw  axes  have  established  the  criteria  for  a consider- 
able portion  of  the  aircraft  design.  It  is,  however,  one  of  the  prime  areas 
for  the  application  of  active  control  technology.  Desirability  of  relaxed 
inherent  stability  arises  from  the  possibility  that  with  smaller  tail  volumes 
significant  reductions  in  total  aircraft  drag  and  gross  weight  can  be  re^alized 
with  invariant  payload  and  mission.  This  is  substantiated  by  the  results  of 
industry  ATT  and  AST  studies  which  show  that  relaxed  inherent  stability  com- 
bined with  center  of  gravity  control  offers  the  largest  payoff  for  the  air- 
craft in  terms  of  gross  weight  reduction. 


Pitch  Stability 

Relaxed  longitudinal  stability  is  one  of  the  largest  areas  of  potential 
benefit  to  be  derived  from  the  application  of  active  control  technology.  We 
will  not,  in  this  paper,  go  into  the  details  of  how  one  implements  active 
controls  for  the  relaxed  stability  condition,  but  we  will  discuss  some  of  the 
design  criteria  involved.  First,  the  basic  considerations  influencing  wing 
location  and  horizontal  tail  surface  size  and  location  are  affected.  The 
horizontal  tail  area,  for  instance,  is  normally  set  for  a conventional  design 
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to  meet  stability  and  control  requirements  over  the  desired  center  of  gravity 
range*  Typically,  the  forward  center  of  gravity  limit  tail  area  requirements 
have  been  set  by  trim  capability  or  by  control  required  to  develop  maximum 
lift  in  the  landing  configuration*  The  critical  condition  depends  on  the  type 
of  control  system  selected,  i*e,,  separate  trim  and  control  surfaces  or  a 
single  surface  providing  both  control  and  trim.  Aft  C.G.  limit  requirements 
have  generally  been  set  by  minimum  levels  of  static  longitudinal  stability. 

For  the  active  control  relaxed  stability  design,  the  horizontal  tail  area  may 
be  set  by  either  the  landing  case  or  by  the  pitching  moment  required  for  take- 
off rotation  at  forward  C.G,  and  by  the  reduced  level  of  stability  or  by  the 
pitching  acceleration  required  for  control  in  the  presence  of  gusts  and  other 
external  disturbances  at  aft  C.G.  These  points  are  illustrated  in  Figure  1, 

The  active  controlled  aircraft  is  rebalanced  with  a farther  aft  center  of 
gravity  range  and  a smaller  horizontal  tail. 

The  deficiencies  in  inherent  stability  might  be  compensated  for  by 
augmenting  Cj^  and  Cj^  . The  degree  of  instability  allowable  will  be  deter- 
mined not  only  by  increasing  stabilization  control  power  requirements  but  also 
by  the  variation  of  trim  drag.  As  the  balancing  tail  load  changes  from  a down 
load  to  an  up  load,  the  longitudinal  component  of  the  tail  lift  vector  changes 
from  a thrust  to  a drag,  significantly  increasing  tail  drag.  Minimum  trim  drag 
usually  occurs  near  zero  static  margin,  as  illustrated  in  Figure  2.  The  exact 
center  of  gravity  location  for  minimum  trim  drag  is  dependent  on  the  particular 
configuration  and  even  on  the  wing  aerodynamic  design. 

As  shown  in  table  1,  some  experience  has  been  gained  with  relaxed  inherent 
stability.  Many  jet  transports  have  augmented  static  longitudinal  stability 
where  the  augmentation  is  a function  of  airspeed.  However,  the  magnitude  of 
relaxation  possible  with  active  control  will  change  the  design  criteria. 

Perhaps  one  of  the  most  disturbing  ideas  that  accompanies  this  changing 
criteria  is  that  we  have  now  replaced  the  easily  calculated  inherent  stability 
requirement  with  a possible  pitching  acceleration  requirement  based  upon  the 
rather  uncertain  magnitude  of  airplane  response  required  under  varying 
conditions  of  flight  and  levels  of  atmospheric  disturbance. 

Flying  qualities  criteria  may  also  be  affected  by  dependence  on  augmenta- 
tion, especially  in  the  pitch  axis.  These  will  be  discussed  later. 


Directional  Stability 

As  shown  in  table  1,  this  is  the  area  where  active  control  has  seen  the 
largest  and  most  widespread  application  in  transport  aircraft.  We  have  seen 
the  yaw  damper  (an  augmented  directional  stability  and  control  system  would 
more  completely  describe  the  systems  currently  flying  on  large  transport  air- 
craft) progress  from  a system  which  was  a nice  passenger  comfort  add-on 
feature  to  a system  which  must  be  operating  in  order  for  the  aircraft  to  be 
cleared  for  flight.  Despite  this,  there  is  probably  much  less  to  be  gained  by 
relaxed  directional  stability  than  by  relaxed  longitudinal  stability.  Currently, 
vertical  tails  are  sized  to  provide  static  directional  stability,  dynamic 
lateral -directional  stability,  and  asymmetric  thrust  control.  Minimum  control 
speed  criteria  are  either  critical  or  close  to  it  in  sizing  the  vertical  tail 
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on  most  transport  designs  with  wing-mounted  engines.  Selection  of  the  minimum 
control  Speed  criteria  may  be  somewhat  arbitrary,  but  two  things  are  generally 
considered; 

1)  The  air  minimum  control  speed  must  be  less  than  the  landing  approach 
speed  at  all  gross  weights. 

2)  Ground  and  air  minimum  control  speeds  may  dictate  the  minimum  takeoff 
ininway  length  and  should  be  set  to  provide  the  desired  capability. 

With  relaxed  inherent  stability  and  if  asymmetric  thrust  control  is  not 
limiting,  the  tail  size  may  be  reduced  to  the  level  where  stabilization  control 
or  airplane  control  response,  as  during  a crosswind  landing  decrab  maneuver, 
become  limiting.  In  either  case,  new  and  unfamiliar  design  criteria  are 
required. 


Control  of  Aircraft  Center  of  Gravity  and  Inertia 

This  area  of  active  control  has  also  been  growing  rather  rapidly.  At 
least  one  transport  aircraft  requires  a sequence  of  wing  fuel  management  in 
order  to  maintain  the  necessary  margins  against  flutter.  Maintenance  of  the 
C.G.  within  limits  on  current  transports  also  dictates  certain  management 
sequences.  It  is  therefore  not  a very  great  step  to  add  to  these  procedures 
some  requirements  for  maintaining  an  optimum  C.G.  location  and/of  inertia  dis- 
tribution for  the  actively  controlled  transport.  It  is  this  distribution  of 
inertia  for  the  entire  aircraft  as  well  as  the  equivalent  C.G.  location  which 
acts  with  the  control  surface  active  control  system  to  provide  the  optimum 
gains  with  relaxed  inherent  stability. 

Automatic  center-of-gravity  control  can  offer  si^iiificant  design 
advantages  in  the  following  ways, 

o Reduction  of  the  design  center-of-gravity  range  at  given  flight 
conditions  may  allow  further  reduction  in  the  horizontal  tail 
volume  coefficient  (refer  to  the  indication  of  ”CG  range on 
figure  1) 

o Minimization  of  total  drag  with  respect  to  center-of-gravity 
location  during  cruising  flight,  as  illustrated  in  figure  2, 


Ride  Quality 

Ride  quality  control  refers  to  automatic  control  system  functions  which 
reduce  to  acceptable  levels  the  accelerations  to  which  passengers  and  crew  are 
subjected.  Factors  such  as  low  wing  loading,  poorly  damped  dynamic  stability, 
structural  flexibility,  atmospheric  turbulence,  and  high  speed,  low  altitude 
flight  all  contribute  to  poor  ride  comfort. 

Ride  quality  problems  have  tended  to  be  secondary  con siderhl ions  with 
respect  to  resolution  of  structural  load  and  flexibility  problems.  In  fact, 
it  was  stated  by  two  members  of  the  panel  that  ride  quality  is  not  a major 
trade  factor  in  design,  because  the  criteria  for  ride  quality  in  the  commercial 
environment  are: 
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o Ride  must  be  merely  acceptable  to  passengers 

o Ride  must  be  competitive  with,  contemporary  commercial  aircraft 
In  addition,  the  aircraft  must  be  readily  controllable  in  turbulence. 

The  control  techniques  for  improving  ride  quality  are  fairly  well  estab- 
lished both  theoretically  and  operationally.  Many  commercial  transports  have 
some  degree  of  ride  quality  control  provided  by  means  of  conventional  control 
surfaces.  The  yaw  damper  systems  of  modem  jet  transports  improve  ride  quality 
even  though  their  fundamental  purpose  is  to  improve  handling  qualities. 

Active  control  for  gust  load  alleviation  has  demonstrated  greatly  reduced 

response  to  turbulence,  thus  assuring  a greater  comfort  for  passengers.  A 
typical  reduction  in  aircraft  response  to  turbulence  obtained  during  the  B52 
LAMS  and  CCV  programs  is  shown  in  Figure  3,  It  will  be  noted  that  the  decrease 
in  response  to  turbulence  is  sensitive  to  the  aircraft  structural  modes  and 
that  a uniform  reduction  at  all  frequencies  is  impossible.  This  led  to  a good 
deal  of  discussion  among  the  panel  members  as  to  the  criteria  for  ride  quality. 
While  certain  maximum  limits  for  ride  comfort  are  relatively  easy  to  establish, 
the  panel  decided  that  detail  criteria  for  ride  comfort  still  need  a consider- 
able amount  of  research  in  order  to  establish  workable  design  criteria.  In 
either  case  it  is  doubtful  that  ride  quality  design  criteria  will  result  in 
weight  savings,  so  the  competitive  pressure  to  supply  a smoother  ride  will 
probably  dictate  the  control  system  design  criteria - 


Load  Control 

Load  control  refers  to  the  use  of  passive  or  automatic  control  functions 
for  the  purpose  of  regulating  the  net  load  and  distribution  of  load  applied  to 
the  aircraft  structure. 

There  are  four  main  facets  of  load  control.  To  some  extent,  all  must  be 
considered  simultaneously  to  achieve  a well-balanced  design  although  some  may 
receive  considerably  more  emphasis  than  others.  Three  facets  of  load  control 
which  are  specifically  discussed  in  this  subsection  are  maneuver  load  control, 
gust  load  control,  and  fatigue  damage  control.  Flutter  control  might  also  be 
included  as  a fourth  facet  of  load  control  because  flutter  is  the  result  of  a 
particular  kind  of  loading.  Flutter,  however,  tends  to  be  disassociated  from 
other  types  of  loading  for  reasons  which  will  be  explained  in  the  flutter  con- 
trol subsection  which  follows. 

The  question  of  load  control  was  perhaps  as  controversial  as  the  question 
of  relaxed  inherent  stability,  and  several  important  points  were  raised 
regarding  each  type  of  load  control. 


Maneuver  Loading 

Maneuver  loading  is  that  portion  of  forces  acting  on  the  airframe  which 
result  from  maneuvers  required  to  maintain  the  aircraft  on  the  intended  flight 
path.  The  distribution  of  this  loading  over  the  airframe  can  have  a powerful 
effect  upon  the  shear  forces  and  bending  moments  which  must  be  transmitted  at 
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given  points  in  the  structure.  The  ability  to  tailor  the  distribution  of 
maneuver  loading  over  the  airframe  is  maneuver  load  control.  Maneuver  load 
control  can  have  a significant  impact  upon  structural  Implementation  and  even 
upon  configuration. 

The  impact  of  tailoring  maneuver  load  distribution  may  be  far-reaching. 

If  the  maximum  reduction  in  fatigue  loading  is  to  be  achieved,  maneuver  load 
control  would  be  desirable  during  all  maneuvering.  When  applied  to  the  wing, 
this  usually  implies  an  ’^unloading*’  of  the  outer  wing,  thus  reducing  the  root 
bending  moment,  as  illustrated  in  Figure  4a.  A high  wing  loading  transport  may 
possibly  be  limited  in  cruise  altitude  by  maneuver  requirements  such  as  those 
specified  in  the  British  Civil  Airworthiness  Requirements . Unloading  a portion 
of  the  wing  would  tend  to  reduce  maneuver  capability,  partieularly  if  wing 
stalling  occurs  inboard.  Thus,  maneuver  load  control  might  tend  to  limit  wing 
loading  or  dictate  a new  approach  to  wing  aerod^mamic  design.  This  situation 
may  be  avoided  by  utilizing  maneuvering  flaps  to  increase  lift  on  the  inboard 
portion  of  the  wing.  Figure  4b.  Additional  aerodynamic  and  structural  design 
considerations  would  still  be  required,  along  with  new  modes  of  control  akin 
to  direct  lift  control. 


Gust  Loading 

Gust  loading  is  that  portion  of  forces  acting  on  the  airframe  which 
result  from  atmospheric  disturbances. 

Gust-load  control  is  accomplished  by  the  following  means; 

o Controlling  the  aircraft  in  such  a way  as  to  produce  a net 

incremental  load  factor  which  tends  to  cancel  the  net  gust-induced 
load  factor.  Because  of  aircraft  inertia,  this  is  best  accomplished 
with  direct  lift  control  devices. 

o Controlling  the  distribution  of  the  incremental  load  which  tends  to 
cancel  the  gust-induced  load  in  such  a way  that  their  distributions 
are  similar. 

o Augmenting  damping  for  modes  excited  by  gusts. 

The  extent  to  which  gust-load  control  is  effective  in  performing  all  three 
listed  functions  can  have  a significant  impact  upon  the  structural  strength 
and  fatigue  requirements. 

Experience  cited  for  the  panel  Indicated  that  the  impact  of  maneuver  and 
gust-load  control  on  reduction  of  structural  requirements  tends  to  be  signifi- 
cant only  when  both  maneuver  and  gust-load  control  are  practiced  simultaneously. 
If  only  one  of  these  load-control  objectives  is  addressed,  then  the  other 
source  of  loading  becomes  critical  before  any  significant  reduction  in 
structural  requirements  is  realized. 


Fatigue 

Cyclical  loading  is  produced  by  forces  applied  to  the  airframe  which 
result  in  stress*~lBvel  oscillations  in  the  structure.  Fatigue  damage  results 
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from  accumulated  stress  cycles  at  given  stress  levels  and  at  critical  points  in 
the  airframe.  Fatigue  damage  control  is  a technique  for  reducing  the  fatigue 
damage  rate  by  using  active  controls  to  reduce  the  number  of  transient  cycles 
at  the  higher  stress  levels  to  which  the  structure  is  subjected  during 
operation. 

The  frequency  range  of  damaging  loads  extends  from  once  per  100  flights 
(e.g.,  from  very  "firm”  landings)  to  the  once  per  flight  of  the  so-called 
ground -air-ground  (GAG)  cycle  and  to  the  characteristic  frequency  of  the 
response  to  turbulence.  The  transition  between  the  ground  mean  loading  and  the 
airborne  mean  loading  of  the  GAG  cycle  accounts  for  as  much  as  80%  of  fatigue 
damage  on  the  lower  wing  skin  on  some  contemporary  transport  aircrafts  Most  of 
the  remaining  damage  accrues  from  incremental  loads  in  the  1/4-  to  1/2-g  range. 

Since  the  mean-to-mean  fluctuation  of  the  GAG  cycle  is  not  amenable  to 
control,  active  control  offers  potential  reduction  of  longitudinal  loads  only 
for  the  incremental  load  fluctuation  about  the  mean  level  of  the  GAG  cycle. 
Large  potential  for  load  reduction  exists  for  lateral  loads  because  there  is 
no  GAG  cycle  effect. 

Much  of  the  panel  discussion  centered  around  the  application  of  the 
classical,  rather  arbitrary  approach  of  a discrete  gust  versus  the  more  modern 
approach  of  "rational  probability  analysis"  coupled  with  careful  mission 
analysis.  The  majority  of  the  panel  agreed  that  we  must  go  even  further  in 
developing  statistical  methods  and  performing  mission  analyses  in  order  to 
realize  the  benefits  to  be  gained  from  the  application  of  active  controls  to 
load  alleviation.  The  obvious  point  here  is  that  if  careful  mission  analysis 
is  applied  to  the  calculation  of  the  fatigue  life  of  the  aircraft  and  if  the 
load  alleviation  control  systems  are  assumed  active  during  the  entire  life  of 
the  aircraft,  the  weight  of  the  aircraft  structure  could  be  reduced  for  the 
same  fatigue  life.  Studies  confirming  this  are  still  in  progress  and  it  is 
difficult  at  this  time  to  come  up  with  definite  criteria.  However,  the  panel 
agreed  that  the  combination  of  maneuver  load  control  plus  gust  load 
alleviation  can  result  in  reductions  of  load  fluctuation. 


Other  Load  Limiting 

Other  forms  of  load  limiting  are  also  useful.  Surface  actuator  capability 
not  only  limits  the  airplane  maneuver  envelope  but  tends  to  limit  the  maximum 
load  on  the  surface  itself.  Many  examples  of  load  limiting  are  in  use  today 
on  jet  transports.  Flap  blowback  or  deflection  limiting  is  in  use  on  several 
aircraft  to  limit  structural  loads.  Rudder  deflection  limiting  as  a function 
of  flap  angle  and  airspeed  is  also  commonly  employed.  As  other  active  control 
modes  are  used  to  reduce  structural  weight  and  margins,  the  use  of  these 
approaches  .will  have  to  be  considered  in  concert  with  the  other  control 
modes  in  a synergistic  design  procedure. 
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Envelope  Limiting 


Envelope  limiting  refers  to  those  functions  in  an  active  control  system 
that  prevent  or  discourage  operation  of  the  aircraft  outside  its  design  or 
operating  envelope. 

Every  transport  aircraft  currently  has  some  form  of  envelope  limit  warning 
and  envelope  limiting,  although  not  usually  in  the  ACT  sense.  Envelope  limit 
warning  takes  the  form  of  stick  shaker  systems  which  warn  of  an  approach  to  the 
stall  and  overspeed  warning  systems  which  warn  that  maximum  operating  speeds 
have  been  exceeded.  Envelope  limiting  is  provided  by  pilot  strength  limita*^ 
tions,  control  surface  actuator  capability,  stick  pushers,  autopilot  authority, 
and  autopilot  automatic  cutoffs  (AGO),  for  example.  The  limits  provided  by 
pilot  or  actuator  strength  may  or  may  not  be  within  the  structural  design 
envelope  of  the  aircraft,  For  instance,  the  pilot  does,  in  some  flight  regimes, 
have  the  capability  of  exceeding  the  design  limit  loads  about  all  axes. 

The  concept  of  envelope  limiting  is  now  being  applied  to  fighter  aircraft 
to  allow  use  of  the  full  maneuver  envelope  without  danger  of  a stall-spin 
departure.  For  transport  aircraft,  the  incorporation  of  active  control  could 
supplement  the  present  warning  and  limiting  features  with  an  automatic  function 
which  prevents  the  aircraft  from  entering  into  a forbidden  flight  regime. 

Angle  of  attack  and  sideslip  limiting  could  avoid  post-stall  loads  and  flight 
characteristics  problems,  and  reduce  vertical  tail  loads.  Overspeed  limiting 
could  reduce  the  required  margin  between  maximum  operating  and  design  dive 
speeds,  as  shown  in  Figure  5,  reducing  design  loads  and  allowing  a lighter 
structure.  The  possibility  of  atmospheric-caused  upset  must  be  considered  in 
establishment  of  minimum  margins.  It  would  then  be  necessary  to  assure  that 
the  flight  control  system  will  satisfactorily  handle  this  job  even  in  the  back- 
up or  degraded  operational  modes  to  assure  that  the  aircraft  is  operated  within 
the  criteria  established  for  strength  of  the  structure.  The  panel- felt,  how- 
ever, that  G-limiting  might  not  be  desirable,  as  there  have  been  several  cases 
where  the  ability  of  an  aircraft  to  exceed  the  design  limit  load  factor  may 
have  avoided  a catastrophic  accident  following  upsets  at  low  altitudes. 


Flutter  Control 

Flutter  control  refers  to  the  use  of  automatic  control  functions  which 
alter  the  apparent  structural  mass  or  stiffness,  or  aerodynamic  damping.  It 
was  the  unanimous  opinion  of  the  panel  that  active  flutter  control  must  be 
considered  as  part  of  ACT  even  if  it  may  not  find  commercial  application  in 
the  near  future.  At  present,  the  nature  of  the  control  law  for  achieving  the 
required  augmentation  seems  extremely  sensitive  to  the  unsteady  aerodynamic 
forces  and  is  also  sensitive  to  the  mass  and  stiffness  distributions  of  the 
airframe.  It  should  also  be  stressed  that  the  flutter  certification  of  the 
aircraft  and  the  flutter  safety  margins  will  be  influenced  by  the  presence  of 
other  active  control  functions.  For  instance,  in  the  case  of  relaxed  inherent 
stability,  it  is  necessary  to  have  a relatively  wide  bandwidth  control  system 
to  cope  with  the  unstable  short  period  mode  roots.  This  control  system  will 
tightly  couple  with  the  basic  flutter  modes  of  the  wing-nacelle-fuselage 
combinations  on  a large  transport  aircraft.  This  will  mean  that  the  safety 
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margin  criteria  for  flutter  will  be  a function  of  the  control  system  loop  gains 
and  general  design.  Criteria  will  also  have  to  be  carefully  developed  to 
account  for  backup  modes  of  operation  of  the  flight  control  system. 


DESIGN  CONSIDERAXIONS  AND  REGULATIONS 


Key  elements  in  bringing  ACT  to  the  point  of  commercial  application  are: 
o Availability  of  proven  design  criteria 
o Limitations  on  ACT  applications  that  may  be  imposed  by 
regulations 

o Availability  of  proven  design  practices  to  guide  the  combined 
application  of  ACT  functions. 

We  are  concerned  mainly  with  the  first  two  items  in  this  paper. 

Design  criteria  are  derived  from  many  sources.  Perhaps  the  most  important 
are  the  manufacturer’s  experience  and  design  philosophy.  Studies  performed  or 
financed  by  NASA  and  DOD  provide  a large  fund  of  suggested  criteria  and  data 
which  the  designer  uses  in  selecting  his  criteria  for  application. 

For  military  aircraft,  mandatory  military  specifications  are  usually 
applied  to  obtain  what  are  considered  to  be  good  characteristics.  In  the  civil 
or  commercial  world  competition  usually  ensures  that  the  aircraft  have  the  best 
characteristics  obtainable,  within  reason.  Safety  is  therefore  the  primary 
purpose  of  the  airworthiness  requirements  contained  in  Part  25  of  the  Federal 
Aviation  Regulations.  These  requirements  must  always  be  kept  in  mind,  as  they 
are  the  standard  by  which  airworthiness  of  the  aircraft  will  be  judged, 

Besides  the  U.S.  FAA  regulations,  the  designer  must  also  consider  the  require- 
ments that  may  be  imposed  by  other  nations  on  aircraft  offered  for  sale  within 
their  territory.  Among  nations  having  specific  airworthiness  requirements  are 
the  United  Kingdom,  France,  the  Netherlands,  Germany,  Italy,  and  Australia. 

Existing  Federal  Airworthiness  Regulations  (FARs)  in  Part  25  do  not  place 
many  significant  constraints  on  the  application  of  ACT.  Those  constraints 
which  are  imposed  tend  to  be  of  the  following  kinds; 

o Interpretations  of  the  fundamental  regulation  intent  were  not  made 
in  a context  which  included  ACT. 

o Practical  considerations  for  demonstrating  compliance  sometimes 
require  arbitrary  maneuvers,  tests,  or  environments  which  have 
no  counterparts  in  normal  or  degraded  modes  of  operation, 
o The  view  of  acceptable  safe  practice  tends  to  be  consistent  with 

the  current  or  recent  past  state  of  the  art  but  not  to  the  projected 
State  of  the  art. 

Existing  regulations  [FAR  25.21(e)]  already  recognize  that  acceptable 
flight  characteristics  may  depend  upon  a stability  augmentation  system  or  upon 
other  automatic  or  power-operated  systems.  This  clearly  admits  ACT  systems  as 
well.  Revisions  to  the  regulations  found  necessary  for  ACT  will  probably 
initially  take  the  form  of  special  conditions  for  certification. 
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In  the  following  paragraphs  we  will  discuss  some  of  the  important  design 
criteria  and  regulatory  problems  affecting  the  implementation  of  ACT. 


Reliability  - Safety 

The  immediate  reaction  of  most  designers  when  faced  with  consideration  of 
ACT  is  to  raise  the  question  of  reliability  and  safety’—^^that  thing  isn^t 
replacing  structure  in  my  airplane  until  it  has  demonstrated  the  same 
reliability  as  primary  structure”. 

It  is  apparent  that  safety  must  not  be  compromised,  and  that  the  criteria 
for  catastrophic  failure  will  be  basically  unchanged.  The  required  level  of 
overall  function  reliability  is  achieved  in  control  and  vital  power  systems  by 
increasing  redundancy  for  those  functions  that  do  not  have  the  desired 
reliability.  For  example,  controllability  of  the  wide-body  Jet  transports  is 
dependent  on  integrity  of  the  hydraulically  powered  controls.  Reliability  for 
safety  of  flight  is  provided  by  multiple  hydraulic  systems.  After  some  number 
of  failures,  it  is,  of  course,  advisable  to  terminate  the  flight  at  the  nearest 
suitable  airport  in  order  to  minimize  exposure  time  in  a non-redundant 
configuration. 

One  difference,  however,  is  that  failures  of  presently  utilized  active 
control  functions  do  not  usually  result  in  reductions  in  structural  capability 
under  normal  flight  conditions,  whereas  proposed  ACT  functions  will,  in  effect, 
replace  primary  structure.  This  does  not  necessarily  mean  that  these  functions 
must  be  as  reliable  as  the  basic  structure,  however.  The  strength  requirements 
will  be  met  already  considering  at  least  one  failure,  so  that  no  reduction  in 
necessary  capability  should  occur  for  the  first  failure.  An  assessment  of 
situation  severity  and  a list  of  means  available  for  reducing  risks  presented 
by  failures  in  ACT  functions  is  given  in  Table  2.  There  are  three  principal 
means  of  controlling  the  risk; 

0 Control  system  redundancy 

o Actuation  and/or  surface  authority  distribution 

o Reduced  operating  envelope 

The  ultimate  levels  of  reliability  will  be  required  only  for  those  functions 
upon  which  safe  termination  of  the  flight  depends. 

Autoland  systems  are  presently  achieving  the  required  reliability,  but 
for  only  a short  exposure  period  during  each  flight.  Figure  6 shows  the 
required  MTBF  as  a function  of  the  number  of  systems  required  to  achieve  a 
probability  of  complete  failure  of  not  more  than  1 x 10*"^  during  a three  hour 
flight. 

The  problems  with  reliability  are  likely  to  occur  within  the  sensing, 
computing,  and  display  functions  which  are  today  largely  restricted  to  flight 
guidance  and  control  systems  (FGCS) . Typical  MTBF  values  for  these  systems 
are  in  the  order  of  300  to  800  hours.  Although  individual  system  reliability 
improvement  is  still  required.  Figure  6 shows  that  the  overall  reliability  goal 
may  be  satisfied  with  a reasonable  number  of  redundant  systems.  Characteristic 
systems  for  this  application  will  include  multiple  channel  command  paths  in 
which  failures  will  be  annunciated,  thus  providing  the  pilot  with  system 
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degradation  information  enabling  him  to  take  corrective  action  prior  to  total 
system  failure.  Ultimately  however,  improved  reliability  goals  and  techniques 
must  be  derived  and  imposed , but  must  always  include  a sensible  system  failure 
mode  and  annunciation  capability. 

An  associated  problem  is  the  FAA  requirement  for  determining  that  safety- 
related  systems  are  functioning  prior  to  dispatch.  Difficulties  in  deteriaining 
sensor  status  have  prevented  taking  credit  for  automatic  cut-offs  (AGO)  in 
limiting  the  consequences  of  autopilot  hardover  failures,  in  some  cases.  This 
will  require  design  of  systems  which  can  be  satisfactorily  checked  on  the  ground. 

Reliability  is  presently  established  in  a manner  whereby  elements  of  the 
system  can  be  specifically  identified  in  a reliability  block  diagr^  and  ^the 
reliability  of  each  element  is  available.  The  reliability  of  the  avionics 
elements  contributing  to  the  flight  safety  of  a control  configured  vehicle 
will  be  significantly  more  complex.  Not  only  are  there  many  more  elements,  but 
the  software  is  an  additional  facet  which  must  be  evaluated.  Accomplishing  the 
failure  and  probability  analyses  of  these  complex  systems  is  a major  task  in 
itself,  and  is  not  within  the  present  state  of  the  art  for  those  ACT  functions 
not  yet  fully  developed.  In  some  cases,  failure  analyses  have  been  required 
to  prove  that  certain  types  of  failures  were  impossible,  which  in  itself  may 
be  a nearly  impossible  task. 


Reliability  - Economics 

The  economics  we  refer  to  here  is  that  of  dispatch  reliability,  not 
maintenance  costs,  although  the  latter  are  certainly  important. 

A typical  design  goal  for  dispatch  reliability  is  that,  mechanically,  the 
aircraft  shall  be  capable  of  departure  within  15  minutes  of  the  scheduled  time 
99  percent  of  the  time.  This  goal  is  very  stringent  and  is  currently  being 
achieved  consistently  by  only  one  transport  aircraft,  the  DC-9.  The  design  of 
this  aircraft  emphasized  simplicity  and  reliability,  whereas  the  design  of 
later  aircraft  has  emphasized  performance,  with  a resulting  increased 
complexity. 

This  dispatch  goal  produces  a desire  to  have  your  cake  and  eat  it,  too. 

The  benefits  of  more  complex  systems  are  desired  but  it  is  also  desirable  to 
allow  dispatch  with  as  many  things  as  possible  inoperative  or  missing.  It  is 
common  to  find  flight  manuals  and  minimum  equipment  lists  filled  with 
information  for  covers,  doors,  and  fairings  missing  or  for  hydraulic  pumps, 
yaw  dampers,  Mach  trim  systems,  autopilots,  antiskid,  and  thrust  reversers 
inoperative.  In  many  cases,  the  benefits  to  be  obtained  from,  and  therefore 
dependency  on,  some  systems  are  limited  by  the  criteria  for  inoperative 
dispatch. 

The  goal  of  1%  delay  rate  is  typically  allocated  among  the  various  air- 
craft systems  as  shown  in  Figure  7.  The  pilot  controls  and  FGGS  are  allotted 
0.005%  and  0.10%,  respectively.  The  small  size  of  these  percentages  does  allow 
some  increase  without  having  a major  impact  on  delay  rate,  but  the  accompanying 
impact  on  maintenance  and  spares  availability  may  be  significant. 
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Flying  Qualities 


Design  criteria  for  flight  characteristics,  or  flying  qualities  of  trans- 
port aircraft  seem  to  be  in  good  shape,  judging  by  pilot  acceptance  of  the 
wide-body  jet  transports.  There  has  been  a steady  improvement  in  flying 
qualities  but,  at  the  same  time,  some  increase  in  the  possible  number  of 
degraded  situations  due  to  increased  system  complexity  and  failure  modes. 

Transport  aircraft  flying  qualities  research  in  the  U.S.  has  received 
more  of  the  attention  it  deserves  in  recent  years  after  previously  having  to 
try  to  adapt  fighter-derived  criteria. 

Since  transport  aircraft  tend  to  be  developed  by  evolution  rather  than 
revolution,  their  flying  qualities  and  criteria  tend  to  evolve  similarly.  The 
FAA  regulations  concentrate  on  classical  stability  characteristics,  primarily 
static,  and  on  steady  state  control  requirements.  Control  response  and  air- 
craft dynamics  receive  scant  mention,  although  awareness  is  much  higher  during 
actual  aircraft  evaluation.  The  need  for  positive  static  stability  is  still 
debated,  but  is  defended  on  the  grounds  of  safety,  i.e.,  reduced  pilot  work- 
load and  fatigue  plus  a tendency  to  stay  put  or  even  recover  from  a disturbance 
during  periods  of  inattention. 

Automatic  and  augmented  flight  control  systems  have  tended  to  evolve  along 
a line  different  from  that  of  basic  or  inherent  flight  characteristics  and 
control  modes.  With  the  advent  of  fully-augmented  active  control  systems,  it 
is  time  that  the  proper  modes  and  parameters  be  determined. 

The  primary  axis  of  concern  is  the  pitch  axis.  In  the  past,  the  provision 
of  adequate  inherent  pitch  stability  has  tended  to  emphasize  long  period  char- 
acteristics:  static  longitudinal  stability,  longitudinal  maneuvering  stability, 

and  speed  or  flight  path  stability.  When  these  characteristics  are  satis- 
factory, and  the  configuration  is  a relatively  conventional  one,  dynamic 
stability  (short  period  mode)  is  generally  completely  satisfactory.  The 
elevator  or  longitudinal  control  is,  over  the  long  term,  an  airspeed  control 
and  the  throttles  are  primarily  a flight  path  control  in  straight  flight;  in 
a somewhat  simplified  sense.  In  actual  practice,  thrust  changes  usually 
produce  some  trim  change  also,  thus  affecting  the  trimmed  airspeed.  With  the 
usual  nose-up  trim  change  with  increased  thrust,  applying  forward  throttle  will 
actually  result  in  a slower  airspeed  but  an  increased  climb  angle. 

The  initial  response  of  the  aircraft  to  rapid  control  usage  is  not  the 
same  as  the  final  effects  on  trimmed  flight,  however.  Elevator  inputs  produce 
a change  in  angle  of  attack,  seen  by  the  pilot  as  an  attitude  change,  which 
only  gradually  manifests  itself  as  a change  of  airspeed.  The  immediate  normal 
acceleration  and  the  ultimate  change  in  airspeed  will  cause  a change  in  flight 
path  and,  as  a result,  in  altitude  unless  the  throttles  are  adjusted  to 
maintain  the  long  term  path. 

Advancing  the  throttle  produces  an  initial  acceleration  which  is  gradually 
transformed  into  a change  in  flight  path  angle  unless  restrained  by  the 
elevator  control.  If  there  is  a large  effect  of  thrust  on  pitching  moment, 
attitude  changes  will  also  occur. 
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Because  of  these  immediate  responses,  the  controls  are  used  in  this 
manner  when  accurate  flight  path  tracking  is  required  over  the  short  term.  In 
fact,  many  pilots  believe  this  is  the  only  correct  definition  of  the  control 
modes . 

The  usual  implementation  of  automatic  flight  control  systems  has  been 
based  on  this  short-tem  control  response.  Autopilots  on  propeller-driven  and 
early  jet  transports  typically  incorporated  attitude  and  altitude  hold  modes. 
Later  autopilot  designs  incorporate  vertical  speed,  airspeed,  and  Mach  hold 
modes,  the  latter  two  more  in  the  line  with  the  long  term  elevator-as-airspeed- 
control  principle.  Later  autopilots  also  include  turbulence  modes,  usually  a 
loose  attitude  hold  with  pitch  rate  damping.  This  mode  evolved  from  experienee 
when  it  was  determined  that  attitude  control  offered  the  best  chance  of 
avoiding  upsets  when  flying  in  turbulent  or  stormy  weather. 

The  advent  of  the  autothrottle  system,  which  tries  to  maintain  airspeed 
with  the  throttles,  dealt  a body  blow  to  the  elevator-airspeed  control  pro- 
ponents. The  final  blow  was  administered  by  the  introduction  of  control  wheel 
steering  (CWS) , in  which  the  pilot  flies  the  airplane  through  a rate  command, 
attitude  hold  mode  of  control.  This  system  can  reduce  the  pilot ^s  workload 
because  the  airplane  is  essentially  always  in  trim  when  the  controls  are 
released. 

What  is  the  effect  of  these  control  modes?  Since  the  elevator  is 
inherently  a displacement  control,  mechanizing  it  qs  a rate  control  signifi- 
cantly changes  the  airplane *s  characteristics.  Conventional  maneuvering 
stability  and  static  stability  become  meaningless,  as  the  airplane  has  neutral 
or  no  stability  in  terms  of  these  flight  parameters.  Singly  or  in  combination, 
autothrottles  and  GWS  can  produce  neutral  or  divergent  flight  path  stability  on 
what  would  otherwise  be  a stable  aircraft.  This  is  graphically  illustrated 
in  Figure  8,  which  shows  airplane  response  following  a pilot-induced  upset 
during  landing  approach.  The  basic  airplane.  Figure  8a,  is  inherently  stable 
and  recovers  to  the  trim  attitude  and  airspeed.  With  autothrottles  engaged, 

8b,  the  attitude  and  flight  path  diverge  following  the  upset.  Control-wheel- 
steering, 8c,'  prevents  attitude  divergence  but  also  maintains  the  airplane  at 
the  commanded  upset  attitude  as  the  flight  path  diverges.  To  the  credit  of 
CWS,  it  must  be  said  that  it  is  much  less  susceptible  to  external  disturbances 
than  to  pilot-induced  upsets. 

These  CWS  systems  do  not  allow  compliance  with  the  stability  requirements 
of  FAR  25.173  and  .175.  They  have  been  certificated  basically  as  autopilot 
control  modes  under  the  requirements  of  FAR  25.1329  and  Advisory  Circular 
25.1329-lA.  They  are  not  considered  as  primary  control  modes  and  have  there- 
fore not  been  evaluated  against  the  basic  stability  requirements.  These 
requirements  therefore  present  a possible  problem  area  in  the  implementation 
of  active  controls,  depending  on  the  control  modes  selected. 

Two  types  of  augmentation  would  be  required  to  match  inherent  stability 
characteristics:  angle  of  attack  stability  and  pitch  damping.  The  latter  is 

fairly  easily  accomplished  but  the  former  requires  direct  measurement  or  a 
combination  of  measurement  and  computation.  Computed  angle  of  attack  is  within 
the  current  state  of  the  art,  although  accuracy  of  either  computed  or  measured 
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a may  be  marginal  for  use  at  high  airspeeds.  In  any  case,  considerable  work 
needs  to  be  done  to  specify  the  proper  flying  quality  parameters  for  airworthi- 
ness evaluation.  Both  the  industry  and  the  FAA  are  active  in  this  area  and 
some  changes  may  result  from  the  formal  review  of  the  regulations  to  be  held 
later  this  year. 

The  envelope  limiting  function  of  ACT  may  also  negate  the  regulation 
stalling  speed  and  characteristics  requirements.  It  would  seem  appropriate 
in  this  event  to  substitute  the  control  limited  minimum  speed  concept. 


Structures 

The  basic  impact  upon  structural  design  criteria  due  to  the  application 
of  active  control  is  in  the  area  of  structural  loads.  In  this  area  it  is  not 
only  desirable  but  also  feasible  to  retain  a considerable  portion  of  the 
structural  design  criteria  which  have  led  to  the  current  generation  of  trans- 
port aircraft,  For  instance  the  1-cos  gust,  as  currently  applied  to  aircraft 
load  calculations,  is  perhaps  not  conceived  on  the  most  rational  basis,  but  it 
nevertheless  serves  as  a standard,  and  it  is  not  necessary  to  modify  it  just 
to  permit  active  controls  in  the  design. 

Maneuver  design  criteria,  on  the  other  hand,  should  be  reviewed  for 
active  controls  application.  For  instance,  the  basic  -1,  +2.5g  load  factor 
criterion  is  deeply  entrenched  in  our  current  transport  design  philosophy  and 
designs  major  portions  of  the  structure.  Instances  are  cited  where  transport 
aircraft  have  had  to  develop  this  maximum  load  factor  in  order  to  survive  an 
upset.  These  instances  caused  the  panel  to  adopt  a negative  position  on  g 
limiting,  as  mentioned  previously.  From  a design  criteria  standpoint  we  need 
to  re-examine  the  conditions  leading  to  these  maximum  load  factor  maneuver 
requirements  and  determine  whether  active  controls  prevent  one  from  ever 
getting  into  this  region  or  perhaps  whether  active  controls  can  cause  even  more 
exaggerated  maneuvers.  In  either  case  the  change  in  structural  weight  of  the 
aircraft  as  a function  of  this  maneuver  requirement  is  considerable. 

Another  instance  where  criteria  changes  are  necessary  is  in  the  computa- 
tion of  aircraft  fatigue  life.  Here  again  a considerable  portion  of  structure 
is  designed  for  fatigue,  and  as  in  the  maneuver  load  factor  case,  the  active 
control  system  has  a considerable  influence  over  aircraft  structural  response 
and  hence  fatigue  life.  It  is  not  clear  that  the  practical  active  control 
system  will  necessarily  reduce  the, response  (and  hence  the  structural  weight) 
of  all  portions  of  the  aircraft,  but  it  is  clear  that  future  criteria  must 
deal  directly  with  the  input  data  required  to  perform  rational  probability 
and  mission  analysis  studies.  This  conclusion  was  strongly  supported  by  the 
panel. 

Another  instance  where  new  structural  design  criteria  must  be  developed 
for  the  active  controlled  aircraft  is  in  the  area  of  abrupt  maneuver  require- 
ments. The  loads  developed  on  the  structure  during  the  abrupt  maneuver  will 
be  vary  dependent  on  how  one  chooses  to  mechanize  the  control  system.  For 
instance  the  transient  loads  developed  during  an  abrupt  time  sequence  of 
elevator  deflections  may  be  considerably  different  from  the  transient  loads 
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developed  during  a similar  deflection  history  of  a flying  tail,  although  each 
may  produce  roughly  the  same  aircraft  C*G.  acceleration.  For  the  aircraft 
which  depends  on  a functioning  active  control  system  at  all  times  the  abrupt 
maneuver  criteria  must  deal  with  defining  the  conditions  which  cause  the 
abrupt  maneuver,  rather  than  defining  the  control  surface  time  history.  The 
following  are  examples  of  these  modes 

a)  Transient  caused  by  switching  from  primary  to  backup  systems 

b)  Transients  caused  by  control  system  failure  modes  such  as, 

’’hardover  command**. 

c)  Evasive  action  for  collision  avoidance. 


Control  Systems 


The  criteria  for  detail  design  of  conventional  control  systems  are 
predominantly  developed  by  the  manufacturers.  These  include  instructions 
regarding  design  to  provide  safety,  ease  of  maintenance,  and  to  prevent 
incorrect  assembly,  for  example.  The  implementation  of  active  controls  will 
necessitate  the  expansion  of  these  rules  to  include  much  more  sophisticated 
applications.  In  the  past  (with  the  possible  exception  of  the  yaw  damper) 
transport  aircraft  have  been  designed  and  certified  to  operate  without  an 
operational  autopilot.  For  the  actively  cGntrolled  transport  the  flight 
controller  becomes  a primary  design  consideration  along  with  structures, 
aerodynamics,  and  propulsion  systems.  It  should  be  noted,  however,  that  a 
start  in  this  direction  is  being  made  with  the  design  of  the  YC-14  and  YC-15 
advanced  medium  STOL  transport  prototypes. 

One  area  which  received  considerable  attention  from  the  panel  is  that  of 
establishing  a math  model  of  the  airframe  and  deriving  design  criteria  for 
establishing  parameter  perturbation  analyses  on  the  model.  This  is  an  area 
that  has  received  considerable  attention  in  missile  and  launch  vehicle  control 
system  design.  Unsteady  aerodynamics  and  structural  dynamic  parameters  were 
singled  out  by  the  panel  as  being  the  principal  problem  areas.  It  was  felt 
that  the  accuracy  of  existing  prediction  methods  was  inadequate  for  optimum 
ACT  system  design.  This  problem  is  being  approached  by  improving  the  methods 
and  by  exploration  of  insensitive  flight  control  systems.  A related  problem 
is  the  variation  in  structural  dynamic  and  aerodynamic  parameters  due  to 
changes  or  differences  in  fuel  and  payload  distribution  that  may  occur  during 
one  flight  as  well  as  between  flights,  along  with  the  variation  of  airspeed, 
altitude,  and  Mach  number  encountered.  Again,  the  insensitive  approach  may 
prove  to  be  the  best  way  to  handle  this  variation  in  parameters. 

The  active  control  system  will  also  be  much  more  demanding  on  control 
system  components  which  are  subject  to  wear.  Because  of  the  higher  gains 
required  by  the  active  control  system,  control  system  components  will  have 
to  meet  tighter  specifications,  and  remain  within  these  specifications  through- 
out the  useful  life  of  the  control  system.  This  requires  new  design  criteria 
for  components  such  as  hydraulic  valves  and  actuators  whose  phase  and  gain 
characteristics  are  affected  by  wear.  It  will  also  require  tighter  tolerances 
on  control  surface  hinges  in  order  to  prevent  low  amplitude,  fatigue  causing, 
limit  cycle  oscillations.  At  the  same  time,  the  automatic  controllers  must 
handle  out-of-tolerance  conditions.  These  conditions  can  occur  due  to 
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manufacturing  tolerances,  aging,  wear,  material  failures,  off-nGminal  power 
supplies,  and  dynamic  characteristics  caused  by  changes  in  environmental 
conditions. 

As  flight  control  systems  become  more  complex,  built-in  test  equipment 
(BITE)  takes  on  greater  importance  as  a means  for  improving  safety,  operational 
reliability,  and  maintenance  costs.  The  design  requirements  for  built-in  test 
equipment  must  include  not  only  static  end  to  end  checks  of  the  control  system 
but  dynamic  checks  as  well.  The  BITE  requirements  should  include  the 
capability  for  these  status  and  performance  checks  by  continuous  on-line 
tests,  inflight  pre-engage  operational  status  tests,  channel  comparison 
monitoring,  and  ground  maintenance  tests.  The  inflight  tests  must  be  capable 
of  detecting  failures  to  the  functional  system  level*  The  ground  checks  must 
isolate  failures  to  the  line  replaceable  unit  (LRU)  level.  The  complexity  of 
the  systems  as  compared  with  the  level  of  capability  of  average  maintenance 
personnel  will  require  very  stringent  design  requirements  to  preclude  faulty 
maintenance  and  provide  ease  of  fault  isolation  and  correction.  It  is 
important  to  note  that  the  background  of  missile  control  system  experience  will 
do  little  to  help  us  formulate  design  criteria  associated  with  many  hours  of 
continuous  operation. 

As  one  of  the  special  conditions  in  the  transport  certification  procedure, 
it  is  specified  that  the  airplane  will  operate  safely  for  at  least  5 minutes 
with  the  primary  electrical  system  inoperative.  The  current  means  of  complying 
with  this  requirement  should  not  be  seriously  impacted  by  the  incorporation  of 
additional  ACT  functions.  For  instance,  several  aircraft  have  air-driven 
electrical  generators  for  emergency  use,  and  the  addition  of  more  ACT  functions 
will  only  add  to  the  electrical  load. 

FAR  25.671  requires  that  the  aircraft  be  controllable  if  all  engines  fail. 
Here  again  the  current  means  for  supplying  electrical  and  hydraulic  power,  in 
the  event  of  all  engines  having  failed,  should  be  sufficient  to  satisfy  the 
needs  of  additional  ACT  functions. 


CONCLUSIONS 


It  is  clear  from  the  information  outlined  in  this  paper  and  from  the  work 
of  the  NASA  Panel,  that  a great  deal  of  work  remains  to  be  done  in  the  area  of 
detail  design  criteria  and  design  practice.  It  is  also  apparent  that  the 
overall  improvement  that  one  can  achieve  by  going  to  active  controls  is,  with 
but  a few  exceptions > not  being  held  back  by  current  regulations  and  basic 
design  criteria. 

The  area  where  the  most  work  needs  to  be  done  is  in  the  detail  design 
criteria  of  the  control  system  itself.  The  problems  center  around  the 
derivation  of  reasonable  design  criteria  for  the  design  of  advanced  flight 
controllers.  Other  problems  are  the  achievement  of  the  reliability  goals  and 
production  of  hardware  which  can  be  maintained  and  manufactured  at  costs 
comparable  to  the  rest  of  the  aircraft  critical  components. 
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As  this  work  progresses,  more  ACT  functions  will  be  proven  to  be  both 
reliable  and  practical,  and  will  be  incorporated  into  the  advanced  transport 
designs . 
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APPLICATION  EXPEEIENCE 


TABLE  2;  DEGRADED  SITUATION  SEVERITY  AND  MEANS  AVAILABLE 


FOR  MODIFYING  RISKS  PRESENTED  BY  FAILURES 


FUNCTION 

SEVERITY  OF  SITUATION 
WITH  FUNCTION 
DEGRADATION 

MEANS  AVAILABLE  FOR  MODIFYING 
RISKS  PRESENTED  BY  FAILURES 

Relaxed  Inherent 
Stability  Augmentation 

Moderate-Very 

Redundancy  + Authority  distribu- 
tion 

Reduced  operating  envelope 
CG  management 

Maneuver 

Negligible-Moderate 

Redundancy  + Authority  distribu- 
tion 

Reduced  operating  envelope 

Load  Gust 

Control 

Negligible-Moderate 

Redundancy  + Authority  distribu- 
tion 

Reduced  operating  envelope 

Fatigue 

Damage 

Negligible 

Reduced  operating  envelope 

't  - - . 

Flutter  Control 

Very-Extreme 

i 

Redundancy  + Authority  distribu- 
tion 

Reduced  operating  envelope 

Ride  Quality  Control 

. 

Negligible-Moderate 

Redundancy  -H  Authority  distribu- 
tion 

Reduced  operating  envelope 

Envelope  Limiting 

Negligible-Mod  erat  e 

Redundancy 

Reduced  operating  envelope 

CG  Control 

Negligible 

Reduced  operating  envelope 

CONVENTIONAL 
ACTIVE  CONTROLS 


TAIL 

AREA 


FIGURE  1.  HORIZONTAL  TAIL  AREA  REQUIREMENTS 


TRIM 

DRAG 


FIGURE  2 . TRIM  DRAG 
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LOADING 


4a.  UNLOADING  OUTER  WING 


4b.  LOADING  INNER  WING 


FIGURE  4.  MANEUVER  LOAD  CONTROL 


MANEUVER  FLAP 


SINGLE  SYSTEM  MTBF  (HOURS) 


POTENTIAL  ENVELOPE  REDUCTIONS 


FIGURE  5.  DESIGN  MANEUVERING  ENVELOPE 


NUMBER  OF  SYSTEMS  REQUIRED 

FIGURE  6.  SYSTEMS  REQUIRED  TO  PROVIDE  PROBABILITY  OF  10“®  FOR  COMPLETE  SYSTEM 
FAILURE 
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FIGURE  8b.  APPROACH  LONGITUDINAL  STABILITY 
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FIGURE  8c.  APPROACH  LONGITUDINAL  STABILITY 
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ADVANCED  CONTROL  TECHNOLOGY  AND 


AIRWORTHINESS  FLYING  QUALITIES  REQUIREMENTS 

C . Thomas  Snyder 
NASA  Ames  Research  Center 

INTRODUCTION 


Advanced  control  technology  poses  a difficult  task  for  the  authorities 
faced  with  specifying  airworthiness  flying  qualities  requirements — and  for 
the  manufacturers  who  must  comply  with  and  anticipate  these  requirements. 
Requirements  for  advanced  civil  transports  employing  this  technology  must  be 
carefully  framed,  such  that  public  safety  is  ensured  and  technological  ad- 
vances in  civil  aviation  are  not  discouraged.  It  is  no  secret  that  exces- 
sively complex  and  overstringent  requirements  discourage  innovation,  while 
clear  and  flexible  requirements  (for  example,  those  that  give  credit  for  re- 
liability in  systems)  encourage  development  and .advances  in  technology. 

The  specification  of  flying  qualities  requirements  involves  considera- 
tion of  the  complete  pilot-airframe-systems  loop,  the  task,  and  the  environ- 
ment. Figure  1 suggests  the  complexity  of  this  job;  many  of  these  advanced 
civil  configurations  tend  to  be  large  and  flexible  and  dependent  on  complex 
control  systems  for  enhancement  of  stability,  control  effectiveness,  and  con- 
trol feel  characteristics  over  enlarged  flight  envelopes,  and  for  numerous 
automatic  control  modes.  The  result  is  a greatly  increased  emphasis  on  fail- 
ure effects  that  degrade  flying  qualities.  Key  questions  being  faced  in- 
clude: How  good  must  the  flying  qualities  be  in  the  failure  condition? 

Which  failures  and  combinations  must  be  demonstrated?  And  how  must  they  be 
demonstrated? 

French  and  British  authorities,  in  preparing  for  Concorde  SST  certifica- 
tion, authored  a new  form  of  flying  qualities  requirements  that  rely  heavily 
on  probabilistic  analyses  (TSS  Part  3,  ref.  1).  In  TSS  3,  the  required 
standard  of  flying  qualities  varies  according  to  the  likelihood  of  the  flight 
condition  occurring,  and  thus  considers  the  wide  range  of  flight  phases, 
system  failure  effects,  and  atmospheric  environment.  Although  it  is  being 
applied  to  Concorde  by  European  authorities  and  some  features  of  the  method 
have  been  utilized  in  U.S.  military  specifications,  the  TSS  3 approach  has 
met  with  mixed  reactions  among  the  U.S.  civil  aviation  community  because  of 
concerns  over  the  practical  Implementation  of  the  method. 

Since  1969,  an  ongoing  NASA/FAA  research  program  has  used  the  Ames 
Flight  Simulator  for  Advanced  Aircraft  (FSAA)  in  the  development  of  certifi- 
cation criteria  for  supersonic  cruise  aircraft.  NASA,  FAA,  industry  repre- 
sentatives, and  British  and  French  airworthiness  authorities  are  participat- 
ing in  this  program.  The  question  of  proper  accountability  of  failures  has 
arisen  on  numerous  occasions.  These  experiences  have  brought  to  a focus  the 
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need  to  review  the  present  treatment  of  failure  cases  in  the  requirements  and 
to  examine  some  of  the  questions  associated  with  implementation  of  the  TSS  3 
type  of  concept. 

This  paper,  which  reports  on  the  findings  to  date  from  a continuing  study 
of  the  subject,  comprises  the  following:  a review  of  the  treatment  of  fail- 

ure cases  in  various  flying  qualities  requirements;  a description  of  methods 
used  and  relevant  lessons  learned  from  recent  Autoland  certification  programs 
as  an  example  of  applied  probability  procedures;  a discussion  of  uncertain- 
ties about  the  TSS  approach;  and  finally  (because  these  procedures  indicate 
an  increasing  reliance  on  simulation  methods) , a description  of  three  recent 
experiences  with  marginal  configurations  that  demonstrate  the  potential  sig- 
nificance of  elements  sometimes  omitted  from  simulation  tests. 


CURRENT  TREATMENT  OF  FAILURE  CASES  IN  VARIOUS 
FLYING  QUALITIES  REQUIREMENTS 


Aircraft  flying  qualities  requirements  deal  primarily  with  controllabil- 
ity, stability,  and  handling  characteristics.  Civil  and  military  require- 
ments were  reviewed  for  the  manner  in  which  failure  cases  were  covered,  the 
amount  of  flying  qualities  degradation  allowed,  the  conditions  under  which 
failures  were  to  be  assessed  (for  example,  introduction  of  atmospheric  ef- 
fects) , and  methods  for  demonstrating  compliance.  (As  used  throughout  this 
paper,  the  term  "failure"  includes  malfunctioning  as  well  as  failure  to 
function;  degraded  system  performance  below  specified  tolerances  represents 
a failure  to  function  properly.)  Documents  reviewed  included  Federal  Avia- 
tion Regulations  applicable  to  transport  category  airplanes  (FAR  25,  ref.  2), 
Tentative  Airworthiness  Standards  for  Supersonic  Transports  (TASST,  ref.  3), 
Industry  recommendations  (AIA  committee  report,  ref.  4 and  SAE  Aerospace 
Recommended  Practice  842B,  ref.  5),  Franco-Brltlsh  Concorde  TSS  Standards 
(TSS,  ref.  1),  and  U.S.  military  specification  (MIL-F-8785B,  as  described  in 
ref.  6). 


Federal  Aviation  Regulations  - FAR  25  and  TASST 

For  orientation,  an  outline  of  FAR  25  is  shown  in  figure  2.  Flying 
qualities  requirements  are  contained  in  "Subpart  B - Flight,"  which  is 
further  broken  down  into  topic  headings.  Although  flying  qualities  are 
closely  interrelated  with  many  performance  requirements  (many  of  which  in- 
volve engine  failure  conditions) , this  discussion  is  primarily  concerned 
with  those  items  indicated  by  an  arrow,  and  the  related  paragraphs  in  "Sub- 
part D - Design  and  Construction"  and  "Subpart  F - Equipment." 

Failure  Cases  in  FAR  25-  Philosophy  towards  treatment  of  failures  has 
undergone  significant  change  in  recent  years.  For  years,  about  the  only 
multiple  failure  cases  were  two-engine-inoperative  control  requirements  and 
a requirement  that/  the  airplane  be  controllable  with  all  engines  inopera- 
tive. Only  single  control  system  failures  were  considered.  In  April  1970, 
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Amendment  25-23  incorporated  a number  of  changes  into  FAR  25  dealing  with 
system  failures  and  introducing  the  consideration  of  multiple  failures. 
Stability  augmentation  systems  and  automatic  systems  were  dealt  with  specif- 
ically. Some  of  the  new  requirements  came  from  the  tentative  SST  require- 
ments and  were  recognized  to  be  generally  applicable  and  needed  because  of 
the  increasing  dependence  on  more  complex  systems  of  the  new  generation  of 
subsonic  transports.  The  example  shown  in  figure  3 Illustrates  the  present 
treatment  of  control  system  failures.  As  Indicated,  FAR  25.671  requires  the 
capability  of  continued  safe  flight  and  landing  after  any  single  control 
system  failure  or  after  any  combination  of  failures  not  shown  to  be  extremely 
improbable. 

Current  FAA  interpretation  of  the  terms  '’probable,”  "improbable,”  and 
"extremely  Improbable"  is  shown  in  the  sketch  below. 


EXTREMELY 

’improbable’ 


-IMPROBABLE- 


■ PROBABLE- 


I I I I I ..  I— I L 1 

10"’’  io“®  10"^  i0“®  io~3 

FREQUENeY  OF  OCCURRENCE  PER  FLIGHT  HOUR 


Failure  cases  in  the  other  aircraft  systems  must  also  be  analyzed  under 
"Subpart  F - Equipment."  In  addition  to  requiring  the  capability  of  con- 
tinued safe  flight  and  landing  after  any  failure  condition  not  extremely 
Improbable,  FAR  25.1309  requires  that  the  systems  and  associated  components 
be  designed  so  that 

"the  occurrence  of  any  other  failure  conditions  which 
would  result  in  injury  to  the  occupants,  or  reduce  the 
capability  of  the  airplane  or  the  ability  of  the  crew 
to  cope  with  adverse  operating  conditions  is  improbable." 

In  addition,  nearly  all  requirement  sets  contain  catchall  paragraphs 
which  are  in  general  terms,  but  provide  evaluation  pilots  basis  for  rejection 
of  unsatisfactory  situations  not  covered  specifically.  An  example  of  this  is 
FAR  25.143  which  states 

"(a)  The  airplane  must  be  safely  controllable  and 
maneuverable  during  - (1)  takeoff;  (2)  climb;  (3)  level 
flight;  (4)  descent;  and  (5)  landing,  (b)  It  must  be 
possible  to  make  a smooth  transition  from  one  flight 
condition  to  any  other  without  exceptional  piloting 
skill,  alertness,  or  strength  and  without  danger  of 
exceeding  the  limit-load  factor  under  any  probable 
operating  conditions  (including  the  sudden  failure  of 
any  engine) . " 
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The  phrase  "under  any  probable  operating  conditions"  is  certainly  sub- 
ject to  interpretation  as  including  failure  cases. 

Failure  Cases  in  TASST-  In  TASST  (ref.  3),  the  FAA  presented  tentatiye 
airworthiness  standards  for  study,  trial  application,  and  comment  during  the 
detail  design  and  prototype  phase  of  supersonic  transport  develo^ent.  A 
number  of  changes  were  proposed  in  this  document  other  than  those  already 
discussed.  Including  requirements  to  cover  automatic  and  manual  trim  system 
malfunctions,  additional  two-engine- inoperative  controllability  and  maneuver- 
ability requirements,  and  extended  "flutter,  deformation  and  fail-safe  cri- 
teria" to  consider  combinations  of  failures  not  shown  to  be  extremely  im- 
probable. In  the  "Stability"  section,  it  was  recognized  that  areas  of  flight 
(for  example,  supersonic  cruise)  may  exist  with  operational  requirements  such 
that  the  use  of  reliable  automatic  flight  control  systems  could  be  accepted 
in  lieu  of  the  demonstration  of  classic  static  stability,  provided  the  loss 
of  automatic  flight  control  would  not  result  in  unsafe  handling  character- 
istics. 

The  "Structures"  section  of  TASST  is  closely  related  to  flying  qualities. 
Paragraph  25.301(e)  states  that 

"For  supersonic  aircraft,  loads  must  be  determined 
within  the  design  flight  envelope  considering  the  ef- 
fects of  stability  augmentation  and  automatic  flight  con- 
trol systems.  Including  probable  f allures  and  changes  in 
systems  characteristics  which  can  be  expected  in  service. 

All  malfunctions  and  failures  of  these  systems  must  be 
considered  under  FAR  25.671  and  FAR  25.1309  within  the 
normal  flight  envelope  except  those  shown  to  be  extremely 
improbable." 

Careful  consideration  of  the  complete  pilot-aircraf t-systems  loop  and 
the  environment  appear  very  important  in  satisfying  this  requirement.  Also 
note  that  this  introduces  the  assessment  of  failure  effects  outside  the 
normal  flight  envelope  (see  sketch) . The  application  of  flight  simulation 
techniques  would  appear  to  be  essential  for  this  task. 

NORMAL  FLIGHT  ENVELOPE  - 
PROBABLE  AND  IMPROBABLE 
FAILURES  (>  10-®  per  hour) 

MUST  BE  CONSIDERED  IN 
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Turbulence  and  Flexibility  Effects-  In  tbe  introductory  discussions  to 
both  the  "Controllability  and  Maneuverability"  and  the  "Stability"  sections 
of  TASST,  it  was  recognized  that  the  effects  of  turbulence  on  the  pilot  en- 
vironment should  be  evaluated.  In  addition,  it  was  pointed  out  that  the 
structural  flexibility  and  stability  characteristics  of  supersonic  trans- 
ports will  undoubtedly  aggravate  the  pilot  environment  problem.  Flight  ex- 
perience with  the  XB-70  and  F-12  series  aircraft  lends  considerable  weight  to 
these  statements — as  have  some  piloted  simulator  experiences  with  large 
flexible  configurations  to  be  described  later.  It  is  very  likely  that  many 
of  the  advanced  transport  designs  will  exhibit  greater  flexibility  than  cur- 
rent subsonic  transports  and,  as  will  be  shown,  the  effects  on  handling 
characteristics  in  failure-mode  operations  can  be  very  significant. 


Industry  Recommendations 

AIA  Study  Group  Proposals-  In  1970,  a special  project  group  represent- 
ing the  Aircraft  Industries  Association  (AIA)  published  the  results  (ref.  4) 
of  a study  to  guide  the  modernization  of  the  Federal  Air  Regulations.  In 
reference  4,  proposed  "modernized"  requirements  are  presented  as  a set  of 
safety  standards  generally  applicable  to  all  transport  aircraft  types. 

These  standards  describe  basic  characteristics  of  the  aircraft  system  that 
must  be  achieved  to  ensure  safe  operation.  In  addition,  means  for  showing 
partial  or  complete  compliance  with  the  Individual  standards  are  Included. 

Two  fundamental  requirements  formed  the  foundation  for  all  the  standards 
proposed: 

"1,  The  aircraft  must  respond  to  commands  of  the  con- 
trolling intelligence  in  a consistent  manner  and 
with  the  precision  appropriate  to  the  task. 

2.  Probable  subsystem  failures  must  not  result  in 
conditions  likely  to  be  catastrophic  due  to  human 
inability  to  cope  with  them." 

These  modernized  standards  specify  three  modes  of  operation  (manual, 
command,  automatic) , conveying  clearly  that  the  controlling  intelligence  is 
not  always  considered  to  be  the  human  pilot.  They  state  further  that  if  man 
is  the  controlling  intelligence,  he  should  be  considered  a subsystem  of  the 
total  aircraft  system.  In  this  way,  the  standard  dealing  with  operation 
following  failures  accounts  for  failures  of  human  origin  in  addition  to  other 
subsystem  failures.  This  standard  states, 

"Operation  following  probable  failure  of  any  subsystem 
that  affects  flight  safety  shall  not  unduly  restrict 
flight  operation  after  corrective  action  is  taken. 

The  degree  of  restriction  permitted  shall  be  inversely 
related  to  the  probability  of  failure." 

It  then  presents  requirements  related  to  the  ability  to  take  corrective 
action,  either  by  the  crew  or  by  automatic  means.  The  acceptable  means  of 
compliance  deal  more  specifically  with  the  failures,  and  include  paragraphs 
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that  parallel  FAR  25.671(c)  and  25.672(c)  (fig.  3) 


SAE  Design  Criteria-  Reconmended  design  criteria  for  handling  qualities 
of  civil  transport  aircraft  (SAE  ARP  842B,  ref.  5)  differ  in  character  from 
the  safety  requirements  described  previously.  These  criteria  represent  ad- 
visory design  information  as  defined  by  the  SAE  and  were  originally  modeled 
after  the  format  of  the  military  specifications  of  the  early  sixties.  These 
criteria  appear  to  have  avoided  the  use  of  probability  terminology  and  in- 
clude consideration  of  single  and  dual  control  system  failures. 

"...  Following  the  [single]  most  critical  failure  in 
the  [power  or  boost]  flight  control  system,  the  planned 
flight  may  be  completed  without  a significant  degrada- 
tion of  flying  qualities.  ...  Following  the  second 
most  critical  flight  control  system  failure,  it  shall 
be  possible  to  complete  the  flight,  after  takeoff,  to 
a suitable  airport  from  the  V2  transition  to  enroute 
climb  to  cruise  to  a safe  landing  with  the  most  critical 
engine  inoperative  at  the  most  critical  phase  of  flight." 

They  further  state  that  failure  of  any  artificial  stability  system  or 
powered-actuated  trim  system  should  not  result  in  an  unsafe  flight  condition 
Some  of  the  quantitative  criteria  (for  example,  lateral  control)  are  rede- 
fined for  the  failure  cases  to  accept  degraded  capability. 

The  significance  of  aeroelastic  effects  is  recognized  in  paragraph 
2.1.7  of  ARP  842B  which  states 

"Since  it  can  be  expected  that  aeroelastic  effects 
will  play  an  important  role  in  Supersonic  transport 
design,  it  should  be  clear  that  all  requirements  for 
flying  qualities  are  applicable  to  the  elastic  air- 
frame." 


Franco-British  TSS  3 

General  Description  and  Objectives-  A new  approach  to  flying  qualities 
requirements  was  developed  by  the  French  and  British  airworthiness  authori- 
ties in  preparation  for  the  certification  of  supersonic  transports,  Concorde 
in  particular.  First  published  in  1969  as  TSS  5 and  since  changed  to  TSS  3 
(ref.  1),  these  requirements  are  currently  being  applied  to  Concorde.  Their 
most  significant  feature  is  the  extensive  use  of  probabilities  and  systems 
analysis  methods  in  defining  the  minimum  acceptable  flying  qualities  for  a 
given  flight  situation,  considering  the  flight  phase,  aircraft  configuration 
failure  state,  and  environment.  The  severity  of  the  requirement  is  directly 
related  to  the  probability  of  occurrence  of  the  flight  situation.  This  con- 
cept has  since  been  utilized  in  the  British  Provisional  Airworthiness  Re- 
quirements for  Civil  Powered-Lift  Aircraft  (ref.  7)  and  in  modified  form  in 
the  current  U.S.  military  specification  MIL-F-8785B. 


,,  t-xy  of 
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This  approach  provides  the  following  significant  advantages: 

1.  a more  systematic  and  complete  coverage  of  all  likely  flight  con- 
ditions, whereas  past  methods  have  tended  to  be  limited  to  antici- 
pated critical  regions 

2.  consideration  of  atmospheric  environment  effects  in  a more  complete 
manner 

3.  a running  assessment  of  the  relative  risk  level  throughout  the  design 
and  development  phases  for  a new  aircraft,  which  provides  Insight  for 
design  modifications 

4.  a method  for  defining  those  cases  that  can  be  eliminated  from  demon- 
stration because  of  the  low  probability  of  occurrence. 

The  TSS  standards  are  intended  to  provide  the  same  safety  levels  for 
supersonic  transports  as  for  subsonic  airplanes  introduced  into  service  at  the 
same  time.  These  objectives  include  the  following:  "For  all  airworthiness 

causes  the  total  probability  of  Catastrophic  Effects  should  be  Extremely  Re- 
mote [<10“^  per  hour  of  flight],  and  the  total  probability  of  Hazardous  Ef- 
fects should  be  remote  [<10“5]  or  Extremely  Remote,"  (See  table  1 for  defini- 
tion of  terms.)  Akin  to  FAR  25,  these  objectives  state  that  "No  single  Fail- 
ure or  combination  of  failures  not  considered  Extremely  Improbable  shall  re- 
sult in  a Catastrophic  Effect."  They  further  require  that  "Remote  Failures 
shall  not  result  in  Hazardous  Effects"  and  that  "Recurrent  Failures  shall  re- 
sult only  in  Minor  Effects." 

The  TSS  3 requirements  are  categorized  into  three  groups,  corresponding  to 
the  accident  causes  attributed  to  flying  qualities:  (1)  handling  - a workload 

consideration,  (2)  maneuverability,  and  (3)  involuntary  exceedance  of  airplane 
limits  caused  by  disturbances  due  to  failures  or  atmospheric  conditions.  Var- 
ious specific  criteria  are  included  which,  depending  on  the  probability  of  oc- 
currence of  a given  "state"  (categorized  as  frequent,  occasional,  exceptional, 
and  non-exc optional) , must  be  satisfied.  There  are  also  a number  of  require- 
ments, based  on  judgment  and  experience,  which  require  demonstration  regard- 
less of  the  estimated  probability  of  occurrence. 

Theoretical  Application-  Figures  4 and  5 Illustrate  theoretical  applica- 
tion of  the  TSS  3 concept.  (Reference  9 points  out  that  practical  applica- 
tion requires  many  simplifying  assumptions,  although  little  information  on 
these  assumptions  has  been  found  in  the  literature.)  First,  the  various 
possible  flight  "tasks"  and  their  associated  probabilities  of  occurrence  per 
flight  are  defined.  As  shown  in  figure  4,  a task  is  defined  by  four  primary 
elements  plus  the  secondary  workload:  (1)  the  flight  subphase,  for  example, 

localizer  capture;  (2)  state  of  the  atmosphere;  (3)  state  of  the  aircraft, 
which  includes  possible  failures;  and  (4)  flight  technique.  Elements  1 and 
4 represent  lists  prepared  by  the  applicant  while  elements  2 and  3 represent 
four-dimensional  matrices.  The  probability  Pjj  of  a given  task  per  flight 
is  then  calculated  from  estimates  of  the  probabilities  of  (1)  performing  a 
given  subphase  per  flight,  (2)  encountering  a given  atmospheric  state  during 
the  subphase,  (3)  having  a given  aircraft  state  during  the  subphase,  and  (4) 
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using  a given  flight  technique. 

Figure  5 represents  the  author’s  interpretation  of  a method  described  in 
TSS  3 for  showing  compliance  with  the  general  handling  requirement.  Pilot 
evaluation  of  a given  task  identifies  a class  of  difficulty  C,  which  is  then 
converted  to  the  probability  Py  that  a pilot  will  not  be  able  to  accomplish 
the  workload.  The  probability  of  a handling  incident  during  a given  subphase 
per  flight  is  determined  by  summation  over  the  classes  of  difficulty  of  the 
product  of  P^  and  Pjj  for  that  subphase.  The  total  probability  of  a hand- 
ling incident  per  flight  is  computed  by  summation  over  all  the  subphases  that 
make  up  a flight.  For  partial  compliance,  this  total  probability  must  then 
be  less  than  a safety  index,  which  has  been  defined  as  an  acceptable  risk 
level. 

TSS  3 states  that  the  demanded  safety  level  is  to  be  demonstrated  by  a 
limited  number  of  flight  tests  proposed  by  the  applicant.  (Justification  for 
tests  omitted  is  also  required.)  The  majority  of  these  are  to  be  conducted 
in  calm  air  or  low  turbulence.  Compliance  with  requirements  for  flight  in 
turbulence  are  to  be  demonstrated  by  a limited  number  of  flight  tests,  sup- 
ported by  theoretical  studies  and  simulator  tests. 

From  this  brief  description,  it  is  clear  that  numerous  questions  can  be 
raised  regarding  the  practical  application  of  this  approach  and  that  consid- 
erable simplifications  are  needed.  In  the  next  section,  simplifications  are 
described  which  have  been  made  in  the  application  of  a similar  procedure  in 
the  U.S.  military  specification.  While  all  the  uncertainties  are  not  laid 
to  rest,  discussions  in  the  following  sections  address  many  of  the  expressed 
concerns,  and  point  the  way  for  continuing  work. 


U.S.  Military  Specification  (MIL-F-8785B) 

Similarity  with  TSS  Concept-  MIL-F-8785B  (presented  with  background  in- 
formation in  ref.  6)  serves  dual  roles  as  design  requirements  and  as  evalua- 
tion criteria.  At  a 1971  AGAED  meeting,  a paper  (ref.  9)  was  presented  com- 
paring the  TSS  3 concept  and  MIL-F-8785B.  It  concluded  that  they  are  basic- 
ally the  same  in  Intents  and  goals,  although  one  distinction  was  made:  in 

addition  to  assuring  that  there  will  be  no  limitations  on  flight  safety  due 
to  deficient  flying  qualities,  MIL-F-8785B  demands  that  mission  effective- 
ness will  not  be  compromised.  Similarity  of  the  two  criteria  is  not  coin- 
cidental; discussion  following  presentation  of  the  AGARD  paper  acknowledged 
the  significant  contributions  made  by  M.  Wanner,  representing  the  Service 
Technique  Aeronautique  of  France  and  a strong  advocate  of  the  TSS  3 concept, 
during  the  preparation  of  MIL-F-8785B. 

A number  of  simplifying  assumptions  have  been  made  to  permit  practical 
application  of  MIL-F-8785B,  including: 

(1)  No  probability  assessment  is  made  for  aircraft  mass  and  mass  dis- 
tribution. A probability  of  1 is  used  for  all  points  in  the 
envelope.  Thus,  probability  of  state  of  the  aircraft  is  dependent 
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on  failure  probabilities  only. 


(2)  No  attempt  is  made  to  estimate  the  probability  of  the  state  of  the 
atmosphere.  The  required  flying  qualities  are  associated  with  the 
state  of  the  airplane.  (A  number  of  specific  flying  qualities  re- 
quirements must  be  met  with  specified  turbulence  conditions,  how- 
ever . ) 

(3)  The  probability  of  being  in  a given  area  of  the  flight  envelope  has 
been  assumed  equal  to  1,  due  to  inability  to  specify  this  value. 

"Levels"  of  Flying  Qualities-  Three  levels  of  flying  qualities  are  de- 
fined in  MIL-F-8785B,  as  shown  in  table  2.  Cooper-Harper  pilot  ratings  gen- 
erally associated  with  the  three  levels  are  also  shown.  Exceptions  to  these 
relationships  exist,  however.  For  example,  level  3 flying  qualities  for  a 
landing  task  would  correspond  to  a pilot  rating  no  poorer  than  6.5  (requires 
adequate  performance;  see  fig.  6). 

The  minimum  required  flying  qualities  are  defined  separately  for  air- 
plane normal  states  and  airplane  failure  states.  For  airplane  normal  states, 
level  1 flying  qualities  are  required  within  the  operational  flight  envelope, 
and  level  2 within  the  service  flight  envelope  (fig.  7) . For  airplane  fail- 
ure states,  the  probability  of  encountering  level  2 flying  qualities  must  be 
less  than  10“^  per  flight  within  the  operational  flight  envelope  and  the 
probability  of  encountering  level  3 flying  qualities  must  be  less  than  10“^ 
per  flight  in  the  operational  flight  envelope  and  less  than  10“^  in  the 
service  flight  envelope. 

Theoretical  Compliance  Procedure-  Figure  8 illustrates  the  procedure 
outlined  in  MIL-F-8785B  for  determining  theoretical  compliance  with  the  fail- 
ure state  requirements.  Airplane  failure  states  that  have  a significant  ef- 
fect on  flying  qualities  are  first  identified  and  the  corresponding  probabil- 
ities of  encounter  per  flight  are  computed,  based  on  the  longest  flight  dura- 
tion to  be  encountered  during  operational  missions.  The  degree  of  flying 
qualities  degradation  associated  with  each  airplane  failure  state  is  deter- 
mined in  terms  of  levels  as  defined  in  the  specific  requirements.  The  most 
critical  airplane  failure  states  are  then  determined  (assuming  the  failures 
are  present  at  whichever  point  in  the  flight  envelope  being  considered  is 
most  critical  in  a flying  qualities  sense),  and  the  total  probability  of 
encountering  level  2 flying  qualities  in  the  operational  flight  envelope  due 
to  equipment  failures  is  computed.  Likewise,  the  probability  of  encounter- 
ing level  3 flying  qualities  in  the  operational  flight  envelope  is  computed. 
The  computed  values  are  then  compared  with  the  requirements. 

Concept  Recommended  for  Civil  Airworthiness  Application-  Many  of  the 
military  specifications  were  originally  recommended  by  Cornell  Aeronautical 
Laboratory,  Inc.  (now  the  Calspan  Corporation)  under  contract  to  the  Air 
Force  Flight  Dynamics  Laboratory.  In  1973,  Calspan  completed  a review  of 
the  "Flight"  subpart  of  the  Yellowbook  (Tentative  Airworthiness  Standards 
for  Powered  Lift  Transport  Category  Aircraft)  for  the  FAA.  The  final  report 
(ref.  11)  proposed  that  the  Yellowbook  be  revised  to  a new  format  based  on 
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many  of  the  Ideas  used  in  the  military  specification  and  in  the  British 
Provisional  Airworthiness  Requirements  for  Civil  Powered-Lift  Aircraft 
(ref.  7). 


General  Observations 

Based  on  review  of  the  various  requirements,  several  observations  can  be 
made.  All  elements  of  the  aviation  ccmmiunity  have  acknowledged  the  need  for 
increased  attention  to  failure  effects  and  have  made  the  transition  from 
single  failure  to  multiple  failure  philosophy.  The  prediction  of  system  fail 
ure  probabilities  and  their  effects  has  become  a significant  factor  in  flight 
certification  of  aircraft  employing  stability  augmentation,  automatic,  and 
powered  control  systems.  For  aircraft  employing  active  controls  technology 
to  full  advantage,  the  system  failures  and  effects  analyses  are  even  more 
important.  This  results  in  a growing  need  for  close  integration  of  the  sys- 
tems and  flying  qualities  disciplines.  Present  U.S.  certification  practice 
appears  to  treat  the  systems  and  flying  qualities  evaluations  somewhat 
separately,  with  the  effects  of  failures  often  defined  by  analytic  means  in 
the  systems  studies.  While  this  procedure  may  have  served  adequately  in  the 
past,  the  foregoing  observations  suggest  that  they  will,  at  the  very  least, 
require  reexamination  for  future  applications. 

General  recognition  is  apparent  that  atmospheric  effects  (e.g.,  turbu- 
lence) can  influence  an  airplane’s  handling  characteristics  significantly  and 
should  be  considered,  although  the  method  of  including  this  is  loosely  de- 
fined. The  high  cost  of  flight  testing,  the  large  number  of  cases  to  be 
evaluated,  the  desire  to  assess  in  specified  atmospheric  conditions,  and  at 
marginally  safe  conditions  can  be  expected  to  increase  the  reliance  on 
piloted  flight  simulators  for  much  of  this  work. 


FAILURE  CASE  ANALYSES  IN  AUTOLAND  CERTIFICATION 


Systems  safety  analysis  procedures  used  in  recent  Autoland  certifica- 
tion programs  represent  current  examples  of  the  application  of  probability 
procedures  to  the  certification  of  total  airframe-systems  combinations,  in- 
cluding consideration  of  atmospheric  effects.  Because  of  the  close  relation- 
ship with  the  evaluation  concepts  previously  discussed,  the  procedures  used 
in  the  Category  IIIA  automatic  landing  programs  for  the  McDonnell  Douglas 
DC-10  and  the  Lockheed  L-1011  (refs.  12-14)  were  reviewed  and  relevant  find- 
ings are  noted. 


Procedures 

The  procedure  described  in  ref.  13  appears  to  be  generally  representa- 
tive of  the  programs  for  both  airplanes.  The  certification  process,  which 
represents  the  final  cycle  of  studies  made  in  the  design  and  development 
phases,  used  progressive  simulation  and  testing,  as  indicated  in  figure  9, 
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in  order  to  minimize  the  amount  of  flight  testing  required.  The  first  step 
was  the  use  of  high-speed  repetitive-operation  simulation  methods  to  accom- 
plish the  millions  of  landings  required  for  establishment  of  the  low  prob- 
ability results  in  a reasonable  time  period.  In  the  second  phase,  several 
thousand  simulated  landings  were  made  using  the  actual  flight  hardware  com- 
puters. The  hydraulic  control  systems  hardware  ("iron  bird")  was  then  added 
to  the  simulation  in  order  to  pick  up  effects  of  any  hardware  imperfections. 
Finally,  a minimal  number  of  flight  test  demonstrations  (on  the  order  of  a 
hundred)  were  made  to  verify  the  high  end  of  the  performance  probability 
curves.  Some  of  the  simulated  failure  effects  were  verified  by  inserting 
failures  into  the  autopilot  during  actual  approaches.  Each  of  these  phases 
was  used  to  verify  the  results  of  the  preceding  phase. 

Environmental  conditions  for  these  simulations  included  turbulence  and 
wind  shear,  with  levels  specified  in  FAA  Advisory  Circular  20-57A.  In  the 
DC-10  program,  key  performance  characteristics  of  the  sensors,  analog  com- 
puter, and  mechanical  controls  were  varied  between  simulation  runs  within  the 
normally  expected  ranges  using  a Monte  Carlo  sampling  routine  (ref.  12). 

Not  evident  in  the  procedure  just  described  is  the  reliability  and 
safety  analysis,  a considerable  task  consisting  'of  an  integrated  combination 
of  several  kinds  of  analyses  and  computer  simulation  techniques.  This  ex- 
tensive process  is  described  in  detail  in  ref.  12.  Suffice  to  say  that  it 
involved  identifying  all  possible  single  and  multiple  faults  in  the  system 
and  their  effects,  eliminating  all  single  faults  that  were  hazardous,  and 
establishing  that  no  multiple  fault  in  the  system  having  a probability  of 
occurrence  greater  than  10“9  per  landing  was  hazardous. 


Relevant  Findings 

Integrated  Programs  Necessary-  Ordinary  numerical  reliability  analyses 
were  recognized  at  the  outset  to  be  inadequate  for  fully  assessing  Autoland 
system  reliability  and  safety.  Because  of  the  basic  system  complexity,  the 
airborne-ground  systems  interfaces,  and  the  numerous  pilot-aircraft  inter- 
faces, integrated  programs  of  laboratory  testing,  computer  analyses,  and 
simulation  were  found  necessary. 

Design  Guidance  Provided-  Certification  considerations  began  with  the 
design  phase.  As  the  system  design  evolved,  the  reliability  and  safety 
analyses  provided  continued  assessment  of  compliance  and  identified  areas 
requiring  design  modification.  Consideration  of  failure  effects  signifi- 
cantly influenced  the  design  of  many  other  aircraft  systems,  for  example, 
electrical  supply. 

Multiple  Failure  Analysis  Found  Manageable-  The  multiple  failure  analy- 
sis appeared  at  first  to  be  an  almost  impossible  task,  requiring  the  com- 
bination of  all  possible  failures  in  all  possible  sequences  and  analyzing  the 
result.  This  task  became  manageable  by  first  defining  what  was  hazardous  and 
then  working  backward  to  find  all  combinations  of  faults  that  could  produce 
the  event. 
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Definition  of  Atmospheric  Disturbances  Needed-  Atmospheric  disturbance 
effects  can  become  primary  design  factors.  In  some  flight  tests,  for  example, 
a condition  not  anticipated  to  be  critical--a  quartering  tailwind*— was  found 
to  be  serious.  Other  flight  test  experience  has  indicated  that  present  spec- 
ified wind  shear  values  may  be  inadequate.  The  potential  significance  of 
such  disturbances  makes  accurate  definition  of  the  atmosphere  essential. 

Broad-based  Engineering  Judgment  Necessary-  A fundamental  merit  and  a 
hazard  of  the  probability  approach  are  revealed  in  this  quotation  from  ref. 

13; 


"The  probability  approach  to  analysis  seems,  from 
experience,  to  have  great  merit  in  that  the  necessity 
to  calculate  very  low  probability  numbers  forces  on 
the  analyst  a discipline  that  makes  him  study  the  sys- 
tem in  greater  detail.  The  danger  in  the  approach  is 
that  the  analyst  may  place  too  much  emphasis  on  the 
techniques  he  has  developed*  and  lose  sight  of  the 
many  assumptions  implied  in  these  techniques.  In 
short,  there  is  a danger  of  placing  implicit  belief 
on  the  accuracy  of  a calculated-  number . This  danger 
can  be  avoided  by  the  use  of  highly  skilled  engineers 
who  are  capable  of  understanding  system  and  aircraft 
operation  as  well  as  the  detailed  working  of  the  cir- 
cuits to  be  analyzed." 


Concluding  Observations 

Although  the  Autoland  systems  safety  analysis  procedures  described  here- 
in appeared  extremely  cumbersome  at  the  outset,  in  actual  practice  they  be- 
came manageable— while  providing  significant  payoffs  in  terms  of  design 
guidance  and  improved  safety.  It  should  also  be  noted,  however,  that  while 
the  effort  involved  in  an  Autoland  certification  program  is  undoubtedly 
large,  the  effort  appears  small  when  compared  to  the  total  effort  required 
in  rigorously  applying  the  procedures  of  TSS  3 to  an  advanced  transport  air- 
craft over  its  entire  flight  envelope.  The  number  of  cases  to  be  considered 
for  Autoland  is  limited;  the  Autoland  process  is  concerned  primarily  with 
the  final  few  minutes  of  flight,  and  the  controlling  intelligence  can  be 
mathematically  modeled  more  readily  than  can  the  human  pilot. 


UNCERTAINTIES  REGARDING  THE  TSS  APPROACH 


While  the  potential  advantages  of  the  TSS  3 type  of  approach  have  been 
shown  to  be  very  significant  (partially  verified  by  the  Autoland  experience) , 
numerous  questions  and  uncertainties  have  been  raised  regarding  its  practi- 
cal implementation.  These  can  be  grouped  under  the  following  headings:  (1) 

reliance  on  probability  methods  and  reliability  prediction,  (2)  size  of  the 
evaluation  matrix,  (3)  use  of  the  pilot  rating  scale,  (4)  definition  of  the 
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atmospheric  environment,  and  (5)  use  of  simulation  methods.  In  the  following 
discussion,  each  of  these  has  been  addressed  in  order  to  provide  some  in- 
sight into  these  topics,  to  dispel  some  fears,  and  to  indicate  where  further 
work  is  needed. 

Reliance  on  Probability  Methods  and  Reliability  Prediction-  Concern  has 
been  expressed  with  regard  to  the  ability  to  define  some  of  the  required 
probabilities,  such  as  the  flight  subphase,  pilot  technique,  and  atmospheric 
environment.  Conservative  engineering  estimates  of  the  first  two  should  be 
possible  with  careful  study.  Definition  of  the  probability  of  a given  atmos- 
pheric environment  appropriate  to  a given  subphase  requires  more  research 
(to  be  discussed  later) . 

In  reliability  and  safety  analyses,  there  is  always  the  danger  of 
"blind  faith"  in  the  calculated  number.  As  pointed  out  in  TSS  3 and  in  refs. 

8 and  15,  these  methods  are  used  as  an  aid,  not  as  the  sole  criterion;  it  is 
essential  that  they  be  combined  with  good  engineering  judgment  and  experience. 
The  practical  limitations  of  a given  method  must  be  taken  into  account  and 
experience  with  other  aircraft  in  service  must  be  factored  into  the  total 
assessment.  For  example,  the  present  safety  assessment  of  redundant  systems 
goes  far  beyond  the  failure  analysis  by  considering  possible  effects  of  er- 
rors by  the  crew  and  maintenance  personnel,  as  well  as  the  effects  of  events 
outside  the  aircraft  which  could  affect  more  than  one  channel  at  a time. 
Redundant  systems  are  checked  for  common  faults  to  ensure,  for  example,  that 
both  electrical  systems  are  not  routed  through  a common  wiring  bundle  or 
under  galleys  and  toilets,  or  that  lines  from  both  hydraulic  systems  are  not 
supported  by  a common  bracket, 

A common  question  asks  how  probability  values  of  the  order  of  10“^  per 
flight  hour  can  be  estimated  with  confidence.  Reference  16  points  out  that 
this  is  exactly  the  reason  for  the  philosophy  that  no  single  failure  can 
create  a catastrophic  flight  condition.  The  period  of  proof -testing  re- 
quired to  prove  this  failure  rate  would  be  impractical.  However,  the  in- 
dividual failure  rates  of  interest  in  multiple-failure  analyses,  of  the  order 
of  10~3j  can  usually  be  estimated  with  reasonable  confidence.  It  is  also 
intended  that  critical  system  failure  records  be  kept  on  new  aircraft  enter- 
ing service  over  the  initial  period  of  operation  to  verify  the  reliability 
estimates. 

Evaluation  Matrix-  The  matrix  of  conditions  requiring  evaluation  under 
the  procedure  described  in  TSS  appears  awesome.  However,  considerable  sim- 
plification appears  possible  and  merits  continued  study.  Also,  in  practice, 
the  number  of  failures  to  be  investigated  normally  turns  out  to  be  a manage- 
able number  (ref . 8) . The  fault  analysis  usually  shows  a limited  number  of 
ways  a system  can  malfunction  following  a variety  of  single  and  multiple 
faults.  Many  can  be  discarded  because  the  result  is  not  serious  or  the 
probability  of  occurrence  is  clearly  satisfactory. 

Use  of  the  Pilot  Rating  Scale-  Concern  has  been  expressed  over  making 
a pilot  rating  scale  a part  of  legal  regulation,  to  be  used  in  determining 
the  minimum  safety  level  of  an  airplane.  Questions  faced  whenever  the  pilot 
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rating  scale  is  used  become  especially  significant  when  it  is  the  minimum 
safe  boundary  being  defined.  Typical  questions  are:  What  pilots  are  to  do 

the  rating,  how  many,  how  to  extrapolate  from  the  flight  test  situation  to 
the  operational  one,  etc.  These  questions  and  others  are  worthy  of  careful 
study  and  resolution.  Considerable  worthwhile  discussion  on  many  of  these 
issues  is  contained  in  ref.  10.  Many  of  the  questions  raised,  however,  are 
not  unique  to  the  TSS  procedure,  but  are  equally  applicable  to  the  present 
evaluation  process  where  the  subjective  opinions  of  the  airworthiness  pilots 
are  key  factors  in  defining  the  acceptability  of  a given  airplane. 

Definition  of  the  Atmospheric  Environment^  Definition  of  the  significant 
elements  of  the  atmospheric  environment  and  associated  probabilities  is  an 
area  receiving  considerable  attention  in  the  U.S.  and  in  Europe,  and  justifi- 
ably so.  The  Influences  of  atmospheric  disturbances  become  especially  trouble- 
some as  flying  qualities  are  degraded  and  the  workload  approaches  the  satura- 
tion point. 

Many  of  the  turbulence  models  currently  being  used  in  simulation  studies 
have  been  tailored  to  match  power  spectra  measurements.  Other  concepts  are 
being  studied.  For  example,  recent  work  in  the  U.K. , stimulated  by  Autoland 
experience,  is  investigating  the  use  of  discrete  gust  patterns  (ref.  17),  and 
work  is  continuing  in  this  country  under  NASA  sponsorship  at  the  University  of 
Washington  and  elsewhere  to  develop  "non-Gaussian"  models.  Also,  an  investi- 
gation devoted  to  verification  or  improvement  of  present  methods  for  modeling 
aircraft  response  to  turbulence  appears  worthwhile. 

Simulation  Methods-  The  preceding  discussions  leave  little  doubt  that  the 
use  of  simulation  methods  will  play  an  increasingly  key  role  in  the  design, 
development,  and  certification  of  advanced  transport  aircraft.  The  applica- 
tion of  simulators  to  the  certification  demonstration  process  must  not  be 
approached  naively,  but  with  appreciation  for  the  limitations  of  these  methods 
and  for  the  degree  of  fidelity  (math  model,  pilot  station  layout,  visual  dis- 
play, motion,  etc.)  required  for  specific  tasks.  Representation  of  the  appro- 
priate workload  level,  for  example,  is  an  important  factor  in  evaluating  mini- 
mum safe  handling  qualities. 

For  a safety  assessment  as  defined  in  TSS  3,  development  of  this  simula- 
tion capability  early  in  the  design  phase,  with  progressive  updating  of  the 
airplane  model  and  the  pilot/pilot  station  interface,  appears  essential.  Ac- 
quisition of  data  for  improvement  of  simulation  fidelity  must  be  factored  into 
layout  of  early  flight  tests.  Accurate  representation  of  failure  annunciators 
and  warning  devices  must  be  incorporated  as  they  are  defined,  as  they  are  im- 
portant elements  in  the  evaluation  of  a proposed  system's  acceptability. 


RELATED  SIMULATION  EXPERIENCES 


The  preceding  discussions  lead  to  the  conclusion  that  the  final  acceptance 
of  many  aircraft  failure  states  may  be  based  largely  on  simulator  evaluations 
(and  engineering  judgment) . Three  recent  simulation  experiences  have  empha- 
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sized  factors  which,  with  more  stable  configurations,  might  have  been  consid- 
ered of  secondary  importance,  but  became  critical  components  requiring  accurate 
representation  in  the  simulation  of  marginal  configurations.  The  first  empha- 
sizes the  significance  of  turbulence  effects,  the  second  Indicates  the  impor- 
tance of  motion  cues  in  critical  tasks,  and  the  third  demonstrates  control 
limitations  that  can  be  imposed  by  structural  mode  effects. 


Turbulence  Effects 

In  1972,  parallel  studies  were  conducted  on  two  simulators  to  Investigate 
the  SAS-failed  approach  and  landing  of  delta-wing  transports  (refs.  18  and 
19).  Three  research  test  pilots  performed  ground-based  evaluations  on  the 
NASA/Ames  six-degree-of -freedom  Flight  Simulator  for  Advanced  Aircraft  (FSAA), 
followed  by  flight  evaluations  on  the  USAF/Calspan  Total  In-Flight  Simulator 
(TIFS),  both  shown  in  figure  10.  In  a matrix  of  twenty  test  configurations, 
seventeen  were  unstable  longitudinally.  The  primary  task  was  an  ILS  approach 
under  IFR  conditions,  breakout  to  VFR  conditions  at  91-m  (300-ft)  altitude, 
visual  approach  and  landing.  A series  of  approaches  with  added  tasks  included 
crosswind  approach,  glide-slope  error  correction,  localizer  error  correction, 
and  moderate  (0.91  m/sec  or  3.0  ft/sec  rms)  turbulence.  Of  these,  the  turbu- 
lence task  proved  to  be  the  most  critical,  although  the  turbulence  intensity 
used  was  not  uncommon  (probability  of  encountering  turbulence  of  0.91  m/sec  or 
greater  is  on  the  order  of  0.1  to  0.3). 

Pilot  rating  data  from  both  investigations  is  shown  versus  a divergence 
parameter,  time  to  double  amplitude  of  angle  of  attack  T2„»  in  figure  11. 

Pilot  ratings  from  the  FSAA  study  are  shown  by  the  shaded  band,  with  the  scat- 
ter primarily  attributable  to  interpilot  variation.  Values  of  ^2^  ^ 

and  greater  were  found  to  be  acceptable  for  the  emergency  case.  As  T£  de- 
creased (divergence  rate  increased)  below  this  level,  pilot  ratings  show  that 
handling  characteristics  deteriorated  rapidly. 

Initial  examination  of  the  TIFS  pilot  rating  data  showed  considerable 
scatter  due  to  the  varying  turbulence  Intensities  encountered  during  the 
flights.  In  analyzing  the  data,  Calspan  used  measurements  of  the  actual  tur- 
bulence environment  to  compensate  the  pilot  rating  data  for  each  configuration. 
These  results  are  shown  in  figure  11  for  gust  intensities  of  0.46  m/sec  (1.5  ft/ 
sec)  and  0.91  m/sec  (3.0  ft/sec).  Although  the  difference  between  the  two 
levels  of  turbulence  intensity  appears  small,  the  differences  in  subjective 
evaluation  were  significant. 


Motion  Effects 

An  investigation  was  conducted  at  Ames  recently  to  identify  the  role  of 
cockpit  vertical  acceleration  cues  in  the  landing  task  (ref . 20) . A piloted 
simulator  having  very  large  amplitude  vertical  motion  (24  meters  total  travel) 
was  utilized  in  a test  series  in  which  the  fidelity  ("washout")  of  the  vertical 
acceleration  reproduction  was  deliberately  varied  over  a wide  range,  represent- 
ing simulators  with  varying  amounts  of  available  vertical  travel.  The  external 
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visual  scene  was  provided  by  a black  and  white  uncollimated  TV  monitor.  The 
airplane  simulation  represented  a large  sweptwihg  business  jet  transport. 

Three  levels  of  static  longitudinal  stability  were  simulated,  corresponding  to 
15  percent  static  margin,  neutral,  and  5 percent  unstable  static  margin. 

The  results  indicated  that  vertical  motion  cues  were  utilized  in  the  land- 
ing task  and  were  particularly  important  in  the  simulation  of  aircraft  with 
marginal  longitudinal  handling  qualities.  Figure  12  shows  a measure  of  landing 
performance,  altitude  rate  at  touchdown,  plotted  against  the  motion  washout 
filter  natural  frequency  (%,  The  corresponding  vertical  travel  requirements 
are  shown  along  the  top  scale.  The  data  indicate  that  the  effect  of  motion  was 
relatively  inconsequential  for  landing  of  the  stable  configuration  with  good 
flying  qualities,  although  an  oscillatory  tendency  was  observed  without  motion. 
However,  with  the  configurations  having  marginal  longitudinal  handling  quali- 
ties, significant  degradation  was  apparent  in  achievable  performance  as  the 
motion  was  constrained  (and  thereby  distorted).  At  values  of  ajm  of  1.0  and 
above,  divergent  flight  path  oscillations  were  common  and  touchdowns  were  es- 
sentially uncontrolled  in  many  landings. 


Structural  Mode  Effects 

In  another  simulation  program  in  which  a very  large  flexible  aircraft  was 
represented  complete  with  structural  modes,  a very  significant  degradation  in 
flying  qualities  resulted  from  the  pilot  station  motions  caused  by  fuselage 
bending.  Evaluations  of  the  completely  unaugmented  airplane  without  motion 
and  body  bending  resulted  in  pilot  ratings  of  5.0  - 5.5  (fig.  6).  With  motion 
and  body  bending,  the  structural  modes  were  easily  excited  and  the  pilots  were 
unable  to  use  the  sharp  pulse  inputs  (in  pitch)  normally  used  for  control  of 
an  unstable  airplane.  This  prevented  the  use  of  effective  control  techniques 
and  yielded  a pilot  rating  of  9. 


Recommendations 

These  examples  have  illustrated  the  fact  that  careful  attention  must  be 
devoted  to  defining  the  simulation  requirements  for  a given  task,  A high  de- 
gree of  sophistication  is  often  required  in  evaluations  of  marginal  cases  if 
confidence  is  to  be  placed  in  the  results.  Practical  design  and  evaluation 
procedures  will  very  likely,  by  necessity,  rely  on  simplified  simulations  (very 
limited  motion,  no  structural  mode  representation,  etc.)  for  the  bulk  of  the 
work.  It  is  emphasized  that  verification  testing  of  critical  cases  should  be 
planned  in  simulation  facilities  which  provide  a high  fidelity  of  the  total 
task  presentation. 


CONCLUDING  REMARKS 


Advanced  transport  aircraft  designs  have  become  increasingly  dependent  on 
complex  flight  control  systems  in  order  to  improve  their  flight  characteristics 
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EEPEODUGBILITY  OF  'i'HE 

FAfiE  IS  POOR 


In  this  report,  various  civil  and  military  flying  qualities  requirements  have 
been  reviewed  with  regard  to  their  treatment  of  failure  cases  and  considera- 
tion of  atmospheric  environment  effects.  There  appears  to  be  common  acceptance 
of  the  philosophy  that  no  single  failure  should  create  an  unsafe  flight  con- 
dition, nor  should  any  combination  of  failures  that  are  not  extremely  improb- 
able. Although  consideration  of  atmospheric  environment  effects  in  handling 
assessments  is  required,  the  method  for  doing  this  is  often  ill-defined. 

There  is  an  increasing  need  for  an  orderly  procedure  for  combining  the 
systems  analyses  (reliability  and  fault  analyses)  with  the  flying  qualities 
evaluation  process,  taking  the  likely  atmospheric  states  into  account.  Such 
a procedure  can  aid  in  the  achievement  of  design  economies  and  a level  of 
safety  equivalent  to  that  of  current  transports;  this  is  a challenging  task 
since  the  contribution  of  system  failures  to  catastrophic  effects  is  at  pres- 
ent a very  small  proportion  of  the  total.  Review  of  the  probability-based 
procedures  described  in  the  Anglo-French  TSS  3 shows  that  additional  develop- 
ment effort  is  needed  to  simplify  implementation.  Simplified  procedures  de- 
scribed in  the  U.S.  military  specification  and  lessons  learned  from  recent 
Autoland  programs  appear  useful  for  continuing  studies  devoted  to  this  pur- 
pose. 


In  order  to  minimize  flight  testing  and  to  enable  evaluation  in  specified 
atmospheric  conditions  and  hazardous  failure  cases,  simulation  techniques  will 
be  used  extensively  in  such  procedures.  Some  recent  simulation  experiences 
emphasize  that  turbulence  effects  significantly  influence  the  pilot  evalua- 
tions of  marginal  configurations,  and  that  evaluation  of  such  conditions  some- 
times requires  more  accurate  representations  of  the  pilot /air craft  interface 
(pilot  station  motions,  etc.)  than  are  provided  in  many  current  engineering 
simulations. 
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Table  1.  Definition  of  probability  terms  (ref.  8) 


Failures 

Effects 

Type 

Definition 

Recurrent  failures 

Minor  effects 

Can  readily  be  counteracted  by  crew  and 
may  Involve: 

(a)  small  increase  in  work  load. 

(b)  moderate  degradation  in  perfor- 
mance or  handling. 

(c)  slight  modifications  to  the  per- 
missible flight  envelope. 

Remote  failures 

Major  effects 

May  produce: 

(a)  significant  increase  in  crew  work 
load. 

(b)  significant  degradation  in  perfor- 
mance or  handling  characteristics. 

(c)  significant  modification  of  the 
permissible  flight  envelope. 

but  will  not  remove  the  capability  to 
continue  a safe  flight  and  landing 
without  demanding  more  than  usual  skill 
on  the  part  of  the  flight  crew. 

Extremely  remote 
failures 

Hazardous 

effects 

These  effects  may  be  more  than  major 
providing  that  the  overall  risk  of 
catastrophe  is  extremely  improbable, 
taking  into  account  likely  crew  action. 

Extremely  improbable 
failures 

Catastrophic 

effects 

Resulting  in  fatalities. 

Reouwent.  (Frequency  of  occurrence  up  to  about  10“^  per  hour  of  flight.) 
Expected  to  occur  from  time  to  time  in  the  life  of  an  airplane. 

Remote.  (Of  the  order  of  lO^S  to  10”^  per  hour  of  flight.)  May  happen  a few 
times  during  the  total  operational  life  of  a type  of  aircraft.  For  ex- 
ample, a remote  failure  includes  failure  of  two  engines  in  one  flight. 

Extremely  Remote.  (Not  expected  to  occur  more  often  than  10“^  per  hour  of 
flight.)  Unlikely  to  occur  during  the  total  operational  life  of  all  air- 
craft of  a type,  but  nevertheless  has  to  be  considered  as  being  possible. 

Extremely  Improbable.  So  extremely  remote  that  it  can  be  stated  with  confi- 
dence that  it  should  not  occur. 


726 


Table  2.-  Flying  qualities  levels  from  MIL-F-8785B 


Level 

Description 

Corresponding 
pilot  rating 
(in  general) 

1 

Flying  qualities  clearly  adequate  for  the  mission 
flight  phase 

1 - 3.5 

2 

Flying  qualities  adequate  to  accomplish  the 
mission  flight  phase,  but  some  increase  in  pilot 
workload  or  degradation  in  mission  effectiveness, 
or  both,  exists 

3.5  - 6.5 

3 

Flying  qualities  such  that  the  airplane  can  be  con- 
trolled safely,  but  pilot  workload  is  excessive  or 
mission  effectiveness  is  inadequate,  or  both. 
Category  A flight  phases  can  be  terminated  safely, 
and  Category  B and  C flight  phases  can  be 
completed. 

6.5  - 9+ 

ATMOSPHERE 


CONFIGURATION 

WEIGHT 

MASS  DISTRIBUTION 
STABILITY  AND  CONTROL  CHAR. 


I 


TASK 


Figure  1.-  Factors  influencing  flying  qualities 
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FAR  25  AIRWORTHINESS  STANDARDS:  TRANSPORT  CATEGORY  AIRPLANES  {ref.  2) 


SUBPARTS 

A.  GENERAL 

B.  FLIGHT 

GENERAL 

PERFORMANCE:  RECIP.  ENGINE  POWERED  AIRPLANES 
PERFORMANCE:  TURBINE  ENGINE  POWERED  AIRPLANES 


CONTROLLABILITY  AND  MANEUVERABILITY 

TRIM 

^ M.II 

STABILITY 

STALLS 

M "" 

GROUND  AND  WATER  HANDLING  CHARACTERISTICS 

MISCELLANEOUS  FLIGHT  REQUIREMENTS 

e. 

STRUCTURE 

D. 

DESIGN  AND  CONSTRUCTION 

a 

E. 

POWERPLANT 

F. 

EQUIPMENT 

■■  1 

G. 

OPERATING  LIMITATIONS  AND  INFORMATION 

Figure  2.-  FAR  25  outline  identifying  sections  of  interest. 


SUBPART  B FLIGHT 


25.181  dynamic  longitudinal,  DIRECTIONAL. 
AND  LATERAL  STABILITY. 

ANY  SHORT  PERIOD  OSCILLATION  OCCURRING 
BETWEEN  STALLING  SPEED  AND  MAXIMUM 
ALLOWABLE  SPEED  APPROPRIATE  TO  THE 
CONFIGURATION  . . . MUST  BE  HEAVILY  DAMPED 
WITH  PRIMARY  CONTROLS  (1)  FREE  AND 
<2)  IN  A FIXED  POSITION. 


SUBPART  B FLIGHT 


25.21(e) 

IF  COMPLIANCE  WITH  THE  FLIGHT 
CHARACTERISTICS  REQUIREMENTS  IS 
DEPENDENT  UPON  A STABILITY 
AUGMENTATION  SYSTEM  OR  UPON  ANY 
OTHER  AUTOMATIC  OR  POWER- 
OPERATED  SYSTEM,  COMPLIANCE  MUST 
BE  SHOWN  WITH  PARAGRAPHS  25.671 
AND  25.672. 


SUBPART  D DESIGN  AND  CONSTRUCTION 


> 


25.671  CONTROL  SYSTEMS  - GENERAL 

(c)  THE  AIRPLANE  MUST  BE  SHOWN  BY  ANALYSIS.  TESTS,  OR 
BOTH  TO  BE  CAPABLE  OF  CONTINUED  SAFE  FLIGHT  AND 
LANDING  AFTER  ANY  OF  THE  FOLLOWING  FAILURES  OR 
JAMMING  IN  THE  FLIGHT  CONTROL  SYSTEM  AND  SURFACES 

WITHIN  THE  NORMAL  FLIGHT  ENVELOPE.  WITHOUT 

REQUIRING  EXCEPTIONAL  PILOTING  SKILL  OR  STRENGTH. 

PROBABLE  MALFUNCTIONS  MUST  HAVE  ONLY  MINOR  EFFECTS 
ON  CONTROL  SYSTEM  OPERATION  AND  MUST  BE  CAPABLE  OF 
BEING  READILY  COUNTERACTED  BY  THE  PILOT. 

(1)  ANY  SINGLE  FAILURE.  EXCLUDING  JAMMING. 

(2)  ANY  COMBINATION  OF  FAILURES  NOT  SHOWN  TO  BE 
EXTREMELY  IMPROBABLE.  EXCLUDING  JAMMING 

(3)  ANY  JAM  IN  A CONTROL  POSITION  NORMALLY 
ENCOUNTERED  , . . UNLESS  THE  JAM  IS  SHOWN  TO 

BE  EXTREMELY  IMPROBABLE  OR  CAN  BE  ALLEVIATED  . . . 

25.672  STABILITY  AUGMENTATION  AND  AUTOMATIC  AND 
POWER-OPERATED  SYSTEMS 

(b)  THE  DESIGN  . . . MUST  PERMIT  INITIAL  COUNTERACTION 

OF  FAILURES  OF  THE  TYPE  SPECIFIED  IN  PARAGRAPH  25.671(c) 
WITHOUT  REQUIRING  EXCEPTIONAL  PILOT  SKILL  OR  STRENGTH. 

BY  EITHER  DEACTIVATION  OF  THE  SYSTEM,  OR  A FAILED 
PORTION  THEREOF.  OR  BY  OVERRIDING  THE  FAILURE  BY 
MOVEMENT  OF  THE  FLIGHT  CONTROLS  IN  THE  NORMAL  SENSE. 

(c)  IT  MUST  BE  SHOWN  THAT  AFTER  ANY  SINGLE  FAILURE  . . . 

(1)  THE  AIRPLANE  IS  SAFELY  CONTROLLABLE  WHEN  THE 
FAILURE  OR  MALFUNCTION  OCCURS  AT  ANY  SPEED  OR 
ALTITUDE  WITHIN  THE  APPROVED  OPERATING  LIMITATIONS 
THAT  ARE  CRITICAL  FOR  THE  TYPE  OF  FAILURE  BEING 
CONSIDERED; 

(2)  THE  CONTROLLABILITY  AND  MANEUVERABILITY  REQUIRE- 
MENTS OF  THIS  PART  ARE  MET  WITHIN  A PRACTICAL 
OPERATIONAL  FLIGHT  ENVELOPE  . . . DESCRIBED  IN  THE 
AIRPLANE  FLIGHT  MANUAL;  AND 

(3)  THE  TRIM.  STABILITY.  AND  STALL  CHARACTERISTICS  ARE 

NOT  IMPAIRED  BELOW  A LEVEL  NEEDED  TO  PERMIT  CONTINUED 
SAFE  FLIGHT  AND  LANDING. 


Figure  3.- 


Example  of  control  system  failure  treatment  in  FAR  25, 
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> PLUS  SECONDARY  WORK 

j (CHECKLIST,  RADIO  TRAFFIC,  NAVIGATION) 

I CONSTITUTE  A TASK 


PROBABILITY  (TASK)  « 

PROB  {SUBPHASE  PER  FLIGHT)  x 
PROB  (ATMOSPHERIC  STATE  DURING  SUBPHASE)  x 
PROB  (AIRCRAFT  STATE  DURING  SUBPHASE)  x 
PROB  (GIVEN  CHOICE  OF  FLIGHT  TECHNIQUE) 


Figure  4.-  Elements  defining  the  "task"  in  TSS  3 (refs.  1 & 16), 


Figure  5.- 


One  possible  method  described  in  TSS  3 (ref.  1)  for 
showing  compliance  with  handling  requirement. 
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HANDLING  QUALITIES  RATING  SCALE 


Deficiencies 

warrant 

improvement 


AIRCRAFT 

CMARMrr»RCTiCS 

DEMANDS  ON  THE  PtLOT 
IN  SELECTED  TASK  Oft  REfHIlRB)  OraRAIlON* 

PILOT 

RATDIO 

Excetient 
Highty  desirabie 

Pilot  compensation  not  a factor  for 
desired  performance 

□ 

Good 

Negligibie  deficiencies 

Pilot  compensation  not  a factor  for 
desired  performance 

B 

Fair  — Some  miidiy 
unpleasant  deficiencies 

Minimal  pilot  compensation  required  for 
desired  performance 

o 

Minor  but  annoying 
deficiencies 

Desired  performance  requires  moderate 
pik^  compensation 

^3 

Moderately  objectionable 
deficiencies 

Adequate  perl ormance  : requires 
considerable  pitot  compensalion 

Very  objectionable  but 
tolerable  deficiencies 

Adequate  performance  requires  extensive 
pitot  compensation 

Major  deficiencies 

Adequate  performance  not  attainable  with 
maximum  tolerable  pilot  compensation, 
ContfoMahiiity  not  in  question 

Major  deficiencies 

Considerable  pilot  comperisation  is  required 
lor  coni  rot 

Major  deficiencies 

Intense  pilot  compensation  is  required  to 
retain  control 

H 

Major  deficiencies 

» Control  wilt  be  tost  during  some  portion  of 
required  operation 

Cooper-Harpst  Rel  NASA  TND-5153 


Figure  6.~  Cooper-Harper  pilot  rating  scale  (ref.  10). 


NORMAL  STATES 


FAILURE  STATES 


OPERATIONAL 

FLIGHT 

ENVELOPE  LEVEL  1 


PROB  (LEVEL  2) 

< 10“2  PER  flight 


PROB  (LEVEL  3) 

< 10-4  per  flight 


PROB  (LEVEL  3) 

< 10-2  PER  FLIGHT 


Figure  7.- 


MIL-F-8785B  minimum 


flying  qualities  requirements 
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REPRODUGBILITY  of  THi 

ORIffiiAL  fim  1 


DURATION  OF  LONGEST  FLIGHT 
DURING  OPERATIONAL  MISSIONS 


Figure  8.- 


MIL-F-8785B  procedure  for  determining  theoretical  compliance 
with  airplane  failure  state  requirements. 
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Figure  9,- 


Progressive  simulation  and  testing  in  Auto  land 
certification  (ref . 13) . 


TOOL  - NASA/AIVIES 
f=LIGHT  SIMULATOR  FOR 
ADVANCED  AIRCRAFT 


TOOL  - USAF/CALSPAN 
TOTAL  IN  FLIGHT 
SIMULATOR 


Figure  10,-  Simulation  study  of  minimum  longitudinal  stability 
for  SAS-f ailed  landing. 
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Figure  11. -- 


Pilot  rating  vs  time 
turbulence  intensity 
delta-wing  transport 


to  double  amplitude  T2q^,  showing  effect  of 
(Og  is  rms  value) . Landing  task,  unaugmented 


CORRESPONDING  TOTAL 
VERTICAL  TRAVEL,  meters 
24  18  11  6.7  4.0  2.4  Q 

I r~ — T T~ — r — 1 — T 


Figure  12.- 


Vertical  motion  effects  on  landing  performance  (ref.  20). 


733 


N76-31165 

nmj  ^ 

HANDLING  QUALITIES  REQUIREMENTS  FOR 
CONTROL  CONFIGURED  VEHICLES 

R,  J.  Woodcock  and  F . L.  George 
Air  Force  Flight  Dynamics  Laboratory 

SUMMARY 


The  rapid  emergence  of  fly-by-wire  and  control-configured  vehicle  concepts 
challenges  us  to  accoxmt  adequately  for  their  potential  effects  on  flying 
qualities.  Failure  mode  probabilities  and  consequences  must  be  considered. 
Adequate  controllability  must  be  provided  for  aerodynaunically  unstable  air- 
craft at  extreme  flight  conditions,  Konclassical  overall  dynamics  of  highly 
augmented  aircraft  create  the  need  for  new  approaches  to  specifying  design 
criteria.  New  control  modes  such  as  direct  force  require  definition  of  bound- 
aries for  usefulness  as  well  as  desirability.  These  considerations  are  being 
incorporated  in  the  continuing  effort  at  the  AF. Flight  D3naamics  Laboratory  to 
review  and  revise  the  formal  military  flying  qualities  requirements.  This 
paper  will  review  the  rationale  and  present  current  results  addressing  the 
above  considerations  with  regard  to  Military  Specification  MIL-F-8785B,  "Flying 
Qualities  of  Piloted  Airplanes". 


INTRODUCTION 


Recently  we  were  asked  to  clear  for  flight  testing  an  airplane  which,  with- 
out added  ballast,  was  predicted  to  be  somewhat  unstable  if  the  stability  aug- 
mentation system  (SAS)  should  fall.  Considering  the  expected  degree  of  inac- 
curacy in  aerodynamic  and  reliability  predictions,  we  recommended  putting  the 
center  of  gravity  somewhat  forward  of  the  SAS-off  maneuver  point—^here  stick 
force  and  deflection  per  g go  to  zero.  Contrary  to  the  MIL-F-8785B  requirement, 
we  did  not  feel  compelled  to  insist  on  a c.g.  location  that  would  assure 
static  speed  stability. 

"What?",  our  Laboratory  Deputy  Director  asked,  "Here  we've  put  so  much 
of  our  resources  into  developing  control-configured  vehicles  to  tolerate 
relaxed  static  stability,  and  now  you  tell  me  all  that  refinement  isn't  neces- 
sary~you  say  a plain  unaugmented  airplane  can  fly  that  way  safely.  Have  we 
wasted  all  that  time  and  money?" 

Well,  there  is  more  to  CCV  than  that  in  several  dimensions,  including  the 
degree  of  allowable  bare-airframe  instability.  But  he  had  made  a valid  point 
one  that  has  bothered  some  of  us  all  along.  We  know  through  observation  that 
pilots  can  control  a moderately  unstable  vehicle  in  the  right  circumstances. 
Haven't  helicopters  been  flying  for  a long  time — and  unstable  airplanes  too! 
Quoting  Amos  Root's  observations  of  the  Wright  brothers'  experiments  at  the 

PAGE  BLANli-  Nu'i' 
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Huffman  Prairie  in  the  sunmer  of  1904^ 

"When  I first  saw  the  apparatus  it  persisted  in  going  up  and 
down  like  the  waves  of  the  sea.  Sometimes  it  would  dig  its 
nose  into  the  dirt,  almost  in  spite  of  the  engineer.  After 
repeated  experiments  it  was  finally  cured  of  its  foolish 
tricks,  and  was  made  to  go  like  a steady  old  horse.  This 
work,  mind  you,  was  all  new.  Nobody  living  could  give  them 
any  advice.  It  was  like  exploring  a new  and  unknown  domain. 

Shall  I tell  you  how  they  cured  it  of  bobbing  up  and  down? 

Simply  by  loading  its  nose  or  front  steering-apparatus  with 
cast  iron.  In  my  ignorance  I thought  the  engine  was  not  large 
enough;  but  when  fifty  pounds  of  iron  was  fastened  to  its  ’nose^ 

(as  I will  persist  in  calling  it) , it  came  down  a tolerably 
straight  line  and  carried  the  burden  with  ease.  There  was  a 
reason  for  this  that  I cannot  explain  here...  Over  one  hundred 
flights  have  been  Hiade  during  the  past  summer.  Some  of  them 
reached  perhaps  50  or  60  feet  above  the  ground.  On  both  these 
long  trips  seventy  pounds  instead  of  fifty  of  cast  iron  was 
carried  on  the  ’noseV." 

2 

Or  read  Ma j . Gen.  Benjamin  D.  Foulois'  account  of  his  experience  at  Ft.  Sam 
Houston  in  1910  as  the  U.S.  Army's  airplane  pilot; 

"We  wanted  to  develop  the  airplane  into  a stable  platform 
for  air  reconnaissance  work.  Old  Nuniber  One  was  the  last  of 
the  Kitty  Hawk  models,  and  with  its  two  elevators  out  in 
front  it  was  about  as  stable  as  a bucking  bronco.  We  con- 
tinued experimenting  there  while  the  Wright  brothers  made 
modifications  back  at  Dayton,  Ohio.  When  one  of  the  elevators 
up  front  was  moved  around  to  the  back,  stability  improved 
somewhat  but  not  enough.  I later  found  out  that  by  using  just 
one  elevator,  the  rear  one,  I had  a platform  that  worked  very 
well.  I could  let  go  of  the  levers  and  make  notes  and 
sketches.  It  got  to  be  an  airplane  that  could  be  used  for 
real  military  reconnaissance." 

3 

Charles  Gibbs-Smith  writes 

"So  when  the  Wrights  built  their  first  glider  in  1900  it 
incorporated  two  ideas  which  the  brothers  were  to  utilise 
throughout  their  early  work — the  intentionally  unstable  aero- 
plane which  could  be  kept  flying  satisfactorily  only  by  the 
pilot's  skill,  and  the  warping  of  the  wings  for  control  in 
roll.  'We  therefore  resolved',  wrote  Wilbur,  'to  try  a 
fundamentally  different  principle.  We  would  arrange  the 
machine  so  that  it  would  not  tend  to  right  itself.'" 

This  was  truly  instability,  as  we  have  seen  from  the  preceding  accounts.  It 
was  exactly  that  concept  of  instability — to  a manageable  degree — that  led 
Lilienthal,  Chanute  and  the  Wrights  to  succeed  where  the  "chauffeurs"  of  highly 
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stable  airplanes  could  not  achieve  controlled  flight.  But  the  early  fliers 
had  a rather  high  accident  rate  which  must  be  attributed  in  part  to  the 
vehicle’s  Instability.  Our  tolerance  today  may  be  less,  even  for  emergencies, 
considering  the  higher  speeds  and  poor  weather  to  which  our  flying  now  is 
subject. 

Even  the  Wrights  soon  recognized  the  need  for  improvement.  In  addition  to 
ballasting  for  a forward  c.g.  and  moving  the  canard  surface  to  the  tail  in 
order  to  move  the  neutral  stability  point  aft,  they  also  investigated  automa- 
tic means^.  It  is  Interesting  to  note  that  their  Patent  No.  2913  for  automa- 
tic stabilization  preceded  Gen.  Foulois'  rearranging  the  control  surfaces  with 
the  Wrights'  help.  For  pitch,  "a  pivoted  vane  acting  under  the  Influence  of 
wind  pressure"  sensed  angle  of  attack  to  control  a supply  of  compressed  air 
which  actuated  the  elevator.  A pendulum  was  specified  "for  lateral  control". 
Operation  of  these  devices  would  not  move  the  pilot's  control  levers.  In  1914 
Orville  Wright  was  awarded  the  Collier  Trophy  for  his  work  on  automatic 
stabilization. 


BACKGROUND  OF  CURRENT  ACTIVITY 

A 

Why,  then,  have  we  been  less  willing  in  recent  times  to  accept  instability, 
even  for  emergencies?  A niimber  of  reasons,  each  with  some  degree  of  validity, 
have  led  to  this  conservatism: 

Until  recent  times  the  failure  rates  of  stability  augmenta- 
tion equipment  gave  the  expectation  of  frequently  experiencing 
the  basic-airframe  characteristics.  Greater  redundancy  was 
not  attractive  because  of  the  increased  cost  and  the  maintenance 
burden  to  keep  it  all  operating. 

Little  is  yet  known  about  the  cumulative  effects  of  several 
poor  flying  qualities  together,  except  that  an  aircraft  that  is 
safe  with  any  one  "unacceptable"  quality  can  become  unflyable 
with  some  combinations  of  these  characteristics.  Further,  a 
number  of  plausible  single  and  multiple  failures  can  degrade 
several  handling  qualities.  Loss  of  just  the  pitch  axis  of 
augmentation,  for  example,  could  degrade  damping,  frequency, 
maneuvering  force  gradients,  friction  and  backlash.  A pilot- 
induced-oscillation  could  not  be  stopped  by  clamping  the 
control  Stick  if  d <Sg/d  n^  is  unstable. 

Viable  designs  have  generally  been  possible-  with  basically 
stable  airframes--at  least  for  conventional  airplanes. 

Little  experience  has  been  obtained  to  define  instability 
boundaries  suitable  for  the  speeds,  tasks,  and  weather  that 
are  now  commonly  encountered  in  operating  aircraft. 

i 

737 


From  the  data  collected  for  MIL-F-8785B^  the  tolerable  amount  of 
instability  is  a function  of  total  damping;  the  data  are  insuffi- 
cient, however,  to  draw  a valid  requirement.  "After  studying 
the  available  data,  it  is  obvious  that  many  factors  influence 
the  amount  of  instability  which  can  be  handled.  Because  even 
a small  instability  can  be  quite  dangerous  under  some  circum- 
stances, it  was  decided  to  require  the  airplane  to  be  statically 
stable  even  for  Level  3.” 

We  need  to  reexamine  these  conservative  requirements  in  order  to  provide  more 
guidance  on  the  circumstances  and  amoiints  in  which  instability  is  safe.  We 
solicit  the  opinions  of  those  present. 


MIL-F-8785B  AND  CCV'S 


In  developing  MIL-F-8785B  we  gave  much  thougjit  to  the  conditions  for 
allowing  degraded  flying  qualities.  We  wanted  to  account  as  much  as  possible 
for  real-world  problems  without  overly  complicating  the  requirements.  Two 
causes  of  degradation  were  considered.  Flying  qualities  giving  less  perform- 
ance or  requiring  more  pilot  attention  are  allowed  outside  the  military- 
specified  Operational  Flight  Envelopes.  This  allows  some  capability  for  adapt- 
ing to  changes  in  mission  without  unduly  penalizing  a design  for  having  a 
larger  flight  envelope  than  required.  After  relatively  infrequent  failures 
(nominally  once  per  hundred  flights)  this  same  level  of  degradation.  Level  2, 
is  allowed  in  the  Operational  Flight  Envelope,  and  further  degradation  is 
allowed  outside  those  boundaries.  Only  rarely  (once  in  10,000  flights)  is 
degradation  beyond  Level  2 allowed  in  the  Operational  Flight  Envelope.  In  any 
case  Level  3 is  a relatively  safe  floor.  Degradation  beyond  Level  3 requires 
special  consideration  on  a case-by-ease  basis,  thus  in  principle  giving  the 
procuring  activity  the  power  of  decision.  The  Special  Failure  States  which 
are  subject  to  this  approval  are  of  several  categories.  In  some  cases  other 
specifications  or  design  practices  give  acceptable  assurance:  the  basic  air- 

craft structure  is  a common  reliability  standard.  In  other  cases  judgment  must 
be  used  to  establish  a point  of  diminishing  returns:  two,  or  three  or  four 

hydraulic  systems  are  used  to  power  essential  flight  controls,  for  example. 
There  also  will  be  cases  in  which  failure  is  expected  to  be  extremely  remote 
in  probability,  but  the  cost  of  a change  or  addition  to  preclude  the  failure 
or  limit  its  effect  is  small  enough  to  warrant  disapproval  of  a Special 
Failure  State.  In  still  other  cases  approval  may  be  granted  if  special  design 
or  test  requirements  are  met. 

Despite  an  occasional  opinion  to  the  contrary,  MIL-F-8785B  does  apply  to 
CCV's  - as  far  as  the  specification  goes.  Although  the  8785B  treatment  of 
response  to  atmospheric  disturbances  is  weak  in  general,  clearly  the  require- 
ments and  the  Level  structure  apply  to  conventional  stability  and  control 
augmentation.  The  Special  Failure  States  provide  a mechanism  "to  assure  that 
the  flight  safety,  flying  qualities  and  reliability  aspects  of  dependence  on 
stability  augmentation  and  other  forms  of  system  complication  will  be  con- 
'Aidered  fully".  The  limitations  for  CCV  application  are  a lack  of  requirements 
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on  direct  force  control,  and  the  expression  of  many  requirements  in  terms  of 
classical  modal  parameters.  I would  like  to  evoke  discussion  of  these  matters 
now,  at  this  meeting. 

Thrust/speed  brake  requirements  were  considered  but  omitted  as  beyond  the 
scope  of  the  specification.  We  are  having  second  thoughts  on  that  now,  and 
will  try  to  arrange  with  the  propulsion  people  for  adequate  coverage  somehow 
between  the  two  disciplines.  A lack  of  experience  with  direct  lift  or  side- 
force  controllers  still  precludes  definitive  requirements  for  those  control 
modes— despite  the  Japanese'  successful  use  of  an  automatic  maneuvering  flap 
in  air  comibat  in  1943;  on  the  outstanding  Kawanishi  Shiden  (George)  fighter.^ 


THE  FORM  OF  DYNAMIC  REQUIREMENTS 

/ 

Reference  to  short-period,  dutch-roll,  etc.  modes  is  not  as  much  a hindrance 
to  CCV  application  as  one  might  first  suspect.  The  idea,  of  course,  is  to 
state  the  requirements  in  a form  we  are  familiar  with,  in  terms  consistent 
with  the  aircraft  characteristics  that  form  the  data  base.  Conventional  sta- 
bility augmentation  modifies  the  parameters  but  not  the  form  of  the  response. 
Recent  flight  control  system  designs,  however,  show  a tendency  to  introduce 
additional  dynamic  modes  at  frequencies  on  the  order  of  the  aircraft  response 
frequencies,  giving  rise  to  overall  motions  unlike  the  conventional  response. 
A'Harrah^,  for  one,  has  pointed  out  the  difficulty  in  associating  short-period 
requirements  with  a particular  pair  of  poles  on  a root  locus.  Nevertheless  it 
is  often  possible  to  find  an  equivalent  classical  aircraft  which  matches  the 
response  of  a more  complicated  dynamic  system  reasonably  well  over  a suitable 
time  period  or  frequency  range.  Then  it  should  be  valid  to  compare  those 
equivalent  parameters  with  modal  requirements.  We  realize  the  need  for  a more 
generally  applicable  alternative  and  hope  to  do  better,  at  least  with  longitu- 
dinal requirements,  in  our  current  revision  effort. 

Alternative  longitudinal  requirements  are  being  Investigated  which  should 
be  more  generally  applicable,  but  at  first  these  will  seem  to  be  of  less 
direct  use  to  the  airframe  designer.  One  possibility  is  Neal  and  Smith's® 
closed-loop  criteria  which  utilize  pllot^ehicle  analysis  with  a specified 
pilot  describing  function  and  parameter  adjustment  rules.  Other  possibilities, 
semi-empirical  in  origin,  involve  properties  of  the  open-loop  Bode  phase 
angle  vs  frequency  curve.  Ideally  a requirement  should  apply  to  all  of: 

The  complete  airplane  attitude  response  including  all 
pertinent  modes  (e.g.,  both  phugoid  and  short  period)  - 

The  airplane  plus  flight  control  system  (i.e.,  including  lags 
and  time  delays) 

The  various  control  element  forms  resulting  from  current 
flight  control  augmentation  concepts 
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The  basic  iimer  attitude  response  features  which  are 
necessary  regardless  of  outer-loop  control  problems 
or  auxiliary  control  (e.g.,  direct  lift) 

Variations  in  pilot  control  technique  (e.g.,  closed- 
loop  bandwidth)  with  control  task  or  flight  phase. 

(adapted  from  Ref.  9). 

CURRENT  ACTIVITY  REGARDING  LONGITUDINAL  REQUIREMENTS 

We  are  also  examining  "envelope"  criteria  in  the  time  and  frequency 
domains — for  example  Malcom  and  Tobie's  C*^0  and  the  McDonnell  Aircraft  re- 
finement.^^ C*  is  a rational  parameter  to  investigate  and  the  envelopes 
facilitate  design.  While  the  specific  criteria  which  have  been  developed 
may  work  for  the  particular  configurations  investigated,  they  seem  to  lack 
validity  in  general  application.  The  refined  C*  and  6*  criteria  do  not  seem 
to  match  the  time-history  ratings  of  Ref.  8 Vol.  II  much  better  than  the  origi- 
nal C*  criteria  do.  However,  as  reference  12  points  out,  it  is  not  realistic 
to  expect  any  single  criterion  to  encompass  all  potential  faults,  especially 
for  high-order  or  multi-mode  systems. 

S^ince  the  publication  of  MIL-V-8785B  in  1969,  a number  of  research  con- 
tracts have  been  sponsored  by  the  AF  Flight  Dynamics  Lab  both  to  generate 
data  and  to  develop  new  requirements  that  encompass  new  technology.  Among 
the  proposed  requirements  currently  being  reviewed  are  the  Calspan  proposed 
longitudinal  maneuvering  criteria  in  reference  13.  Longitudinal  attitude  and 
normal  acceleration  control  is  related  to  frequency  response  characteristics, 
considering  desirable  pilot  compensation  needs.  An  attractive  feature  is 
elimination  of  the  need  to  identify  short  period  frequency  and  damping  - a 
real  advantage  for  highly  augmented  airplanes.  However,  measurement  of  a 
slope  and  phase  angle  from  the  pitch  frequency  response  amplitude  versus  phase 
angle  plot  is  required.  This  does  necessitate  knowledge  of  the  aircraft/ 
flight  control  system  longitudinal  frequency  response  function.  The  practica- 
lity of  identification  with  currently  available  computer  algorithms  and  flight 
test  data  commonly  recorded  is  being  evaluated.  Also  being  Investigated  is 
the  practicality  of  generating  an  equivalent  transfer  function  which  would 
allow  presentation  of  requirements  in  terms  of  "equivalent"  parameters  or, 
perhaps,  required  pilot  compensation  parameters.  This  concept  of  incorporating 
pilot  workload  and  transfer  functions  relates  requirements  more  directly  to  the 
designer;  but  the  difficulty  of  accurately  fitting  an  arbitrary  frequency 
response  curve  with  a specified  transfer  function  form  is  significant. 

14 

A recent  experimental  program  studied  the  task  dependence  of  require- 
ments such  as  those  described  above.  Using  the  AF  variable  stability  T-33, 
variations  in  pilot  rating  were  shown  for  some  high-order  configurations 
as  a function  of  evaluation  task.  The  configurations  most  affected  by  task 
variation  all  exhibited  relatively  high  dominant  natural  frequencies.  In 
evaluating  the  Calspan  proposed  requirements,  Mayhew^^  illustrated  the 
influence  of  closed-loop  bandwidth  on  Neal  and  Smith's  flying  qualities 
parameters.  He  has  also  shown  the  relationship  between  the  proposed 
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requirements  and  the  current  familiar  short  period  criteria.  While  the 
Calspan  proposal  includes  some  provision  for  bandwidth  variation,  further 
evaluation  will  determine  if  additional  provision  is  required. 

A different  approach  to  flying  qualities  criteria,  amenable  to  use  in  the 
design  phases  is  based  on  the  "paper  pilot"  concept  first  proposed  by 
Anderson^®.  Reference  12  developed  a computerized  method  of  handling  quali- 
ties analysis  based  on  this  idea  which  showed  relatively  good  correlation  for 
"conventional"  airplanes  - but  less  successful  for  designs  representative  of 
CCV  technology.  However,  this  result  is  not  conclusive  because  the  empirical 
nature  of  the  criteria  involved  require  a good  data  base  for  validation.  Such 
a basis  does  not  exist  for  CCV  airplanes.  Hence,  the  general  approach  does 
warrant  further  study  for  future  application. 


CURRENT  ACTIVITY  REGARDING  LATERAL-DIRECTIONAL  REQUIREMENTS 


The  present  lateral-directional  dynamic  requirements  are  intended  to  mini- 
mize undesirable  yaw  due  to  roll,  and  dutch-roll  excitation.  These  goals  may 
be  satisfied  by  the  basic  airplane  design  or  by . incorporating  augmentation 
(with  proper  attention  to  reliability).  Consequently,  these  requirements  are 
consistent  to  a high  degree  with  CCV  design  approaches.  Specification  of 
response  characteristics  such  as  Posc/Pav  consistent  with  the  philosophy 
being  explored  for  the  longitudinal  requirements,  though  modal  items  are  not. 

Reference  9 has  proposed  a new  requirement  for  heading  control  which  is 
intended  to  address  the  problem  of  adverse  yaw  more  directly.  The  approach 
is  to  evaluate  the  roll-yaw  control  coordination  required  in  a turn  against 
a desirable  standard  for  a coordinated  turn.  Obviously  this  criterion  could 
be  applied  to  design  of  a CCV  system  as  well  as  evaluation  of  conventional  air- 
planes. General  applicability  of  this  criterion  (or  some  variation  thereof) 
to  CCV  designs  incorporating  different  control  modes  to  achieve  heading  control 
remains  to  be  investigated,  although  reference  9 indicates  the  criterion  is 
insensitive  to  airplane  class  or  type.  Also,  as  with  the  proposed  longitudi- 
nal requirements,  the  practicality  of  measuring  or  Identifying  the  response 
characteristics  needed  remains  to  be  established. 

Direct  side  force  control  is  frequently  mentioned  in  conjunction  with  CCV 
and  as  noted  previously  is  an  area  where  definitive  flying  qualities  data  are 
scarce.  Before  such  data  can  be  generated,  a complete  understanding  of  the 
way  pilots  employ  direct  side  force  in  various  tasks  (Flight  Phases)  mus^t  be 
developed.  For  example,  they  may  in  some  cases  employ  side  force  to  perform 
either  a flat  turn  or  side  slip  in  tracking.  Another  application  could  be 
to  trim  out  a crosswind  effect.  Also,  the  effect  of  interaction  with  other 
controls  and  with  other  subsystems  such  as  displays  must  be  explored.  Recent 
efforts  at  AFFDL  have  looked  at  the  weapon  delivery  task^^  and  STOL  landing^®. 
Additional  work  currently  underway  will  hopefully  bring  us  to  the  point  of 
developing  some  new  requirements. 
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Display  interaction  and  cockpit  controller  characteristics  in  general 
require  further  study  before  definitive  requirements  can  be  developed  to 
encompass  some  aspects  of  CCV  technology.  In  some  cases,  it  is  simply  a 
matter  of  generating  data.  For  example,  pilot  rating  and  performance  data 
are  necessary  to  develop  quantitative  requirements  on  force  levels  and 
gradients  (including  nonlinearities)  for  sidesticks.  Display  interaction  trust 
be  considered  when  evaluating  flying  qualities  as  a function  of  task  and  also 
as  a function  of  control  mode.  For  example,  the  evaluation  of  direct  side 
force  control  for  weapon  delivery  mentioned  above  considered  only  fixed  gun- 
sights.  To  complete  the  evaluation  it  will  be  necessary  to  consider  the 
effect  of  active  gunsights  on  the  pilot's  use  of  direct  side  foce. 


LIMITING  FACTORS 


In  concluding,  then,  we  reiterate  that  in  many  respects  the  current  flying 
qualities  requirements  are  compatible  with  CCV  technology.  In  some  areas, 
new  requirements  or  expansion  of  old  ones  is  needed.  In  these  areas,  where 
new  requirements  are  being  formulated,  we  are  certainly  considering  CCV  and 
where  necessary  attempting  to  gather  new  data.  The  following  basic  flying 
qualities  considerations,  however,  might  be  termed  as  limitations  on  the 
general  application  of  CCV  technology. 

How  much  static  instability  can  be  tolerated  safely?  An  absolute  bound  is 
apparent  from  "critical  task"  studies^^,  which  show  that  divergence  of  a 
simple  system  is  controllable  if  its  time  to  double  amplitude  is  within  cer- 
tain bounds,  depending  upon  pilot  workload.  Boeing  SST  simulations^®  found  a 
criterion  of  T?>6  sec  to  set  the  safe  aft  c.g.  limit.  The  critical  task  has 
also  been  used  as  a side  task  in  pilot-vehicle  studies,  the  magnitude  of  the 
controllable  unstable  time  constant  being  a measure  of  pilot  workload^l.  The 
amount  of  divergence,  then,  which  can  be  handled  safely  is  seen  to  depend 
upon  the  amount  of  attention  a pilot  can  devote  to  controlling  it.  That  in 
turn  is  a function  of  the  task's  inherent  difficulty  (e.g.,  landing  approach  vs 
cruise)  and  the  level  of  other  flying  qualities  (e.g.,  concurrent  failures  of 
command  augmentation  or  in  another  axis  of  stability  augmentation)^. 

Another  necessary  limit  on  static  instability  is  the  amount  of  control 
remaining  for  recovery.  Proposed  criteria  have  ranged  from  little  more  than 
static  balance^^  to  MIL-F-83300's^^  half  the  nominal  control  moment  (for  forward 
flight)  and  specified  attitude  changes  in  1 second  (for  hover) . Sensitivity 
to  gusts  is  a consideration.  Any  requirement  is  bound  to  be  somewhat  arbitrary 
because  experience  is  limited.  Here  too  we  solicit  opinions  and  data. 

Control  surface  rate  must  also  be  adequate,  even  in  emergency  conditions. 

A 1972  General  Dynamics  study  shows  convincing  time  histories  of  the  wild 
maneuvers  that  can  result  from  insufficient  surface  rate  for  stability  aug- 
mentation. In  an  internal  study,  Watson,  Bennett  and  Kouri  systematically 
varied  the  parameters  of  "a  small  CCV  fighter  airplane  design",  seeking 
generalized  design  criteria.  That  at  least  is  a start  toward  a specification 
requirement . 
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From  considerations  leading  to  the  current  requirements^,  we  have  the 
following  discussion  relative  to  instability  and  Failure  States  of  the  air- 
plane. 

The  Level  3 requirements  generally  apply  in  the  worst  possible  Failure 
States{.  Except  for  approved  Special  Failure  States,  then,  MIL-F-8785’s  static 
stability  requirement  does  not  permit  basic-airframe  speed  instability 
(elevator  surface  fixed).  Cases  will  arise,  however,  in  which  the  procuring 
activity  is  asked  to  consider  allowing  basic-airframe  instability  as  a 
Special  Failure  State.  Even  if  the  reliability  of  stability  augmentation 
should  be  judged  sufficiently  high,  or  if  the  degree  of  instability  seems 
acceptable  in  itself,  a number  of  aspects  of  combined  airframe-flight  control 
system  behavior  in  normal  operation  need  to  be  examined  before  accepting 
appreciable  instability  in  a Special  Failure  State. 

Obviously,  extremes  of  either  stability  or  instability  require  more 
control  to  balance  the  airplane  throughout  an  angle-of -attack  range.  In  the 
stable  case,  at  the  control  limit  the  airplane  at  least  has  a restoring 
tendency.  But  when  an  airplane  has  an  unstable  variation  of  elevator-surface 
position  with  airspeed,  the  surface  position  required  to  maintain  off-trim 
airspeeds  is  in  a direction  which  reduces  the  control  available  to  initiate 
recovery  to  the  trim  speed.  If  the  unstable  gradient  is  large  enough,  the 
pilot  could  fly  far  enough  off  the  trim  speed  that  there  would  be  no  elevator 
control  available  for  recovery.  With  the  elevator  against  the  stops,  the 
airspeed  would  continue  to  diverge  and  the  pilot  would  be  powerless  to  prevent 
it  from  doing  so.  Examples  of  this  behavior  can  be  found  in  Mach  tuck  for 
subsonic  airplanes  and  during  wave-offs  for  some  propeller-driven  airplanes. 

For  Airplane  Normal  States,  then,  over  the  entire  permissible  range  of 
speed  and  altitude,  safety  comparable  to  that  of  a stable  basic  airframe  would 
require  pilot-control  and  control-surface  authority  to  balance  the  airplane  at 
positive  and  negative  ultimate  load  factors,  with  some  margin  of  control  power 
remaining,  wherever  the  basic  airframe  is  unstable,  (In  flight  test,  of 
course,  limit  load  factor  would  not  intentionally  be  exceeded.)  For  a given 
configuration,  the  elevator  surface  and  control  positions  for  balance  deter- 
mine the  amount  of  control  authority  left  for  stabilization  and  control.  The 
relative  authority  and  interactions  of  command,  augmentation  and  trim  controls 
are  important  considerations.  Authority  and  rate  saturation  may  be  particu- 
larly important  for  dual-purpose  controls  such  as  elevens.  With  aerodynamic 
instability  and  higher-order  flight  control  system  dynamics,  limit  cycles  also 
become  of  increasing  concern. 

In  both  Normal  and  Failure  States,  the  augmentation  must  maintain  appropri- 
ate levels  of  stability  in  responses  to  both  control  and  disturbance  inputs. 

For  a basically  unstable  airframe,  the  sizes  of  these  inputs  should  be  stated 
specifically,  rather  than  taking  a primarily  qualitative  approach.  Some 
margin  above  structural  design  gusts  and  turbulence  might  be  suitable.  The 
required  augmentation  authority  may  exceed  the  pilot's  control  authority. 
Hard-over  failures  should  be  made  impossible  in  the  flight  control  system; 
engine-failure  transients  conceivably  could  be  critical.  Large  control  inputs 
of  various  forms  and  phasing  should  be  considered.  The  response  to  disturbances 
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during  commanded  maneuvers  must  be  considered.  The  effect  of  flight  at  off- 
trim  conditions  on  all  these  factors  must  be  examined. 


Particular  attention  is  needed  for  the  stall  and  spin  recovery  requirements. 
Increased  dependence  on  control  systems  and  artificial  stability  makes  surviva- 
bility after  damage  or  failure  an  important  consideration  for  high-angleTof- 
attack  flight. 

Stall  limiters  and  departure  preventers  are  already  developed  as  fixes  for 
current  fighter  airplanes- — the  F-111  Stall  Inhibitor  System^^  and  the  A-7 
departure  preventer^Sj  for  example.  Manufacturers  whose  aircraft  do  not  need 
such  devices  expound  on  the  air  combat  advantage  attainable  at  extreme  angles 
of  attack;  rapid  deceleration,  for  example,  to  change  positions  with  an 
enemy  attacking  from  the  rear.  Certainly  aerodynamic  design  for  stall/post- 
stall stability  remains  an  important  consideration  for  CCV  design,  in  order  to 
avoid  completely  uncontrollable  situations.  The  Air  Force  Flight  Test 
Center's  Stall/Post-Stall/Spln  Flight  Test  Demonstration  Requirements  for 
Airplanes,  MIL-S-83691A,  rightfully  stresses  the  need  to  demonstrate  extreme 
resistance  to  loss  of  control.  The  required  testing  subjects  all  aircraft  to 
a degree  of  "gross"  abuse  beyond  normal  maneuvers.  Highly  maneuverable  air- 
craft are  to  be  even  more  completely  wrung  out.  Thus  limiters,  while  cer- 
tainly useful,  can  supplement  but  not  replace  aerodynamic  design  at  high  angle 
of  attack. 

In  determining  the  adequacy  of  stall  limiters,  control  authority  and  rate, 
one  must  choose  the  size  of  disturbance  to  be  allowed  for.  Turbulence  level 
is  important;  both  MIL-F-8785B  and  the  proposed  MIL-F-9490D  flight  control 
system  specification  give  models  and  Intensities  for  turbulence  up  to  thunder- 
storm intensities.  Single  disturbances  are  likely  to  be  critical.  These 
include  gusts,  wind  shear,  wakes  of  buildings,  etc,  near  the  runway  and  jet 
wakes.  The  British  revisers  of  AvP  970  flying  qualities  requirements  are 
considering,  in  addition  to  Gaussian  turbulence,  pairs  of  ramp  gusts  to  evoke 
the  worst  response.  Gl]m  Jones*  development  of  this  approach  is  proceeding.^® 
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SESSION  VIII 


THE  F-12  SERIES  AIRCRAFT  APPROACH  TO  DESIGN  FOR 
CONTROL  SYSTEM  RELIABILITY 


F . L.  Schenk  and  J . R,  McMaster 
Lockheed-California  Company 


SUMMARY 

This  paper  presents  a review  of  the  F- l2r-,series  aircraft  control 
system  design  philosophy  as  it  pertains  to  functional  reliability.  The 
basic  control  system,  i.  e. , cables,  mixer,  feel  system,  trim  devices, 
and  hydraulic  systems  are  described  and  discussed.  In  addition,  the 
implementation  of  the  redundant  stability  augmentation  system  in  the 
F-12  type  aircraft  is  described.  Finally,  the  functional  reliability  record 
that  has  been  achieved  is  presented. 


INTRODUCTION 

The  F-12  series  aircraft  were  designed  more  than  a decade  ago, 
yet  they  included  concepts  which  have  only  recently  become  popular  and 
even  acceptable.  One  of  these  is  the  fact  that,  to  a certain  extent, 
the  F-12  aircraft  are  control  configured  vehicles  (CCV).  They  were 
designed  with  the  objective  of  minimizing  trim  drag  to  enhance  the  range 
capabilities.  This,  of  course,  immediately  implies  either  very  low  or 
no  static  stability  requiring  the  full  time  services  of  a pitch  stability 
augmentation  system  (SAS).  At  high  Mach  numbers,  the  Mach  effects 
reduce  the  directional  stability.  Since  an  engine  failure  or  inlet  unstart 
can  produce  a violent  transient,  it  is  rather  obvious  that  the  services  of 
a full  time  yaw  stability  augmentation  system  is  also  important,  both 
from  the  standpoint  of  pilot  comfort  and  prevention  of  structural  damage 
to  the  aircraft.  These  factors  dictate  a full  time  stability  augmentation 
system  in  both  the  pitch  and  yaw  axes  and  with  a functional  reliability 
comparable  with  that  of  the  basic  vehicle  itself.  This  paper  presents 
descriptions  of  the  basic  aircraft  control  system  and  the  redundant  sta- 
bility augmentation  systems  that  permitted  us  to  achieve  the  necessary 
functional  reliability. 
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MANUAL  CONTROL  SYSTEM 

The  configuration  of  the  F-12  series  aircraft  is  illustrated  in 
Figure  1.  The  shaded  areas  show  the  hydraulically  actuated  aerodynamic 
control  surfaces.  The  large  inboard  and  outboard  elevons  are  utilized 
for  pitch  and  roll  control.  Pilot  control  stick  motion  is  separated  into 
pitch  and  roll  commands  by  the  eleven  mixer  assembly  located  in  the  air- 
craft's tail  cone.  The  outboard  eleven  is  slaved  to  the  inboard  eleven 
through  a crossover  linkage  system  which  transmits  commands  across  the 
hot  aft  nacelle.  The  crossover  linkage  contains  a preloaded  spring  cart- 
ridge to  avoid  structural  damage  should  the  outboard  surface  jam.  The 
rudders  are  really  all-movable  vertical  tails  to  provide  the  necessary 
controllability  during  engine  failure  or  inlet  unstart. 

The  aircraft  contains  four  hydraulic  supply  systems;  two  of  these  are 
dedicated  to  the  control  system.  The  two  control  system  hydraulic  supplies 
are  designated  as  System  A and  System  B.  The  eleven  surface  actuators 
are  arranged  such  that  alternating  cylinders  are  supplied  by  Systems  A and  I 
Thus,  if  either  hydraulic  system  is  lost,  the  remaining  system  will  con- 
tinue to  provide  power  for  the  actuation  of  all  of  the  surfaces.  The 
verticals  have  a similar  load  sharing  arrangement. 

Since  the  A and  B valves  porting  hydraulic  oil  to  the  surface 
actuators  are  on  a common  shaft  and  in  close  proximity  to  each  other, 
it  is  necessary  to  protect  against  intersystem  leakage  in  the  event  of  the 
loss  of  one  of  the  hydraulic  supplies.  This  is  done  by  providing 
"scavenger"  jet  pumps  in  the  return  area  for  both  systems.  This  results 
in  the  return  of  any  leakage  oil  back  to  the  reservoir  of  the  appropriate 
supply  instead  of  loss  into  the  failed  supply. 

The  roll/pitch  eleven  mixer  is  a relatively  simple  device  containing 
the  roll  and  pitch  feel  springs  and  trim  actuators.  No  complexities  such 
as  bobweights  or  q-bellows  are  employed,  and  as  a result,  has  proven  to 
be  quite  reliable.  The  feel  springs  for  the  verticals  are  located  in  the 
stub  fin  and  are  incorporated  into  the  yaw  trim  actuators. 

Transmission  of  pilot  stick  commands  to  the  eleven  control  surfaces 
is  achieved  by  dual  cable  systems  to  the  mixer  and  from  thence  to  the 
summing  levers  of  the  inboard  servo  eleven  valves.  The  rudder  pedal 
motion  is  also  transmitted  via  a dual  cable-pushrod  system  to  the  sum- 
ming levers  of  the  vertical  servos.  The  variations  in  required  cable 
length  due  to  temperature  effects  and  flexure  of  the  relatively  long  fuse- 
lage is  compensated  for  by  the  use  of  tension  regulators. 
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Electrical  power  is  provided  by  two  identical  genei*ators,  each  driven 
by  one  of  the  engines.  The  generators  are  synchronized  and  in  normal 
operation  share  the  load.  If  either  generator  fails,  an  autdpiatic  relay  system 
disconnects  the  failed  system  transferring  the  total  load  tOj  tjhe  remaining 
generator.  If  both  engines  quit,  causing  loss  of  both  genq'r^tors,  a 
battery /inverter  supplies  power  to  the  essential  bus  until  ,/t^e  engines  are 
restarted.  / / 

AUTOMATIC  FLIGHT  CONTROL  SYSTEM  (AtteS) 

The  design  goal  of  the  automatic  flight  control  system  for  the  F-12 
series  aircraft  was  to  provide  optimum  handling  qualities  in  the  primary 
flight  regimes  of  the  aircraft.  However,  another  consideration  was  to 
provide  as  simple  a system  as  possible  in  order  to  enhance  reliability. 

Since  the  vehicle  was  the  first  supersonic  cruise  vehicle,  and  thus  would 
spend  the  greater  portion  of  its  flight  time  at  high  Mach  number  cruise, 
the  handling  qualities  had  to  be  optimum  at  these  conditions.  In  addition, 
it  was  also  imperative  to  provide  good  response  and  controllability  in  the 
critical  areas  of  the  flight  envelope  consisting^  of  takeoff,  landing  and 
refueling.  All  other  flight  conditions  Were  considered  transitional  where 
handling  qualities  could  be  less  than  optimum  in  the  interest  of  simplicity. 


The  automatic  flight  control  system  of  the  F-12  series  aircraft  con- 
sists of  the  stability  augmentation  system  (SAS),  the  autopilot  and  the  Mach 
trim  system.  The  autopilot  is  primarily  to  provide  pilot  relief  modes, 
and  although  high  reliability  for  this  function  is  desirable,  it  is  not  essen- 
tial to  safety  of  flight.  Thus,  the  only  protective  measures  taken  in  the 
implementation  of  the  autopilot  is  the  provision  of  duplex  fixed  authority 
limits  set  to  prevent  excessive  transients  for  hardover  failures.  The 
pilot  can  also  disengage  the  autopilot  by  depressing  a trigger  switch  on 
the  control  stick, 

\ 

^ N. 

The  Mach  trim  system  is  also  not  a safety  of  flight  parameter.  Its 
function  is  to  provide  speed  stability  in  the  subsonic  and  low  supersonic 
speed  regime  during  manual  flight.  Loss  of  this  function,  however,  re- 
quires increased  pilot  attention  and  workload  in  maintaining  airspeed. 

To  protect  against  runaway  trim  failures,  a trim  power  switch  is 
located  directly  ahead  of  the  pilot's  left  knee  for  easy  access.  This  is 
necessary  for  two  reasons;  loss  of  pilot  mobility  due  to  the  pressure  suit 
and  the  multiplicity  of  circuit  breakers.  This  switch  cuts  power  to  all 
trim  systems  before  a runaway  trim  can  cause  the  requirement  of  exces- 
sive forces  to  hold  the  aircraft  in  trim.  Once  the  runaway  condition  is 
stopped,  the  pilot  can  locate  and  pull  the  proper  circuit  breakers  and  then 
reengage  the  trim  power  switch  to  restore  power  to  the  unfailed  systems. 
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STABILITY  AUGMENTATION  SYSTEM  (SAS) 


As  was  stated  earlier,  the  F-12  series  aircraft  have  very  low  pitch 
static  stability  and  yaw  directional  stability  at  design  flight  conditions. 
This  requires  a greater  dependence  on  stability  augmentation  during 
maneuvers  and  during  engine- out  transients.  This,  of  course,  dictates 
significant  percentages  of  full  manual  authority.  The  comparative  "author- 
ities are  shown  in  Table  I.  The  magnitude  of  these  authorities  is  such 
that  pitch  or  yaw  hardover  failures  could  be  catastrophic  at  certain  flight 
conditions.  This,  combined  with  the  fact  that  the  pitch  and  yaw  SAS 
functions  are  essential  to  safety  of  flight,  dictates  they  be  implemented 
with  a functional  reliability  comparable  to  that  of  the  basic  aircraft  or 
that  of  a fly- by- wire  system. 


SAS  REDUNDANCY  AND  LOGIC 

Because  of  the  importance  of  the  yaw  and  pitch  SAS's,  they  are 
implemented  with  triple- redundancy  in  sensors,  electronics  and  gain 
scheduling.  The  roll  SAS  is  not  critical,  both  from  the  standpoint  of 
handling  qualities  and  transients  due  to  hardover  failures.  However, 
the  roll  SAS  is  the  inner  loop  for  all  of  the  lateral  autopilot  modes. 

Thus,  to  ensure  the  desired  pilot  relief  and  comfort,  the  roll  SAS  has  a 
dual  mechanization. 

The  servos  for  the  pitch  axis  are  two  dual  tandem  series  servos, 
each  dual  servo  driving  an  inboard  elevon.  The  tandem  pair  are  coupled 
to  each  other  by  a stiff  spring  such  that  both  servos  will  track  even  if 
one  is  disengaged.  If  either  servo  were  to  jam,  the  other  will  still 
perform  its  function  by  distorting  the  spring.  This  does  mean  that  if 
the  "downstream”  servo  of  a,  tandem  pair  were  jammed,  the  pitch  SAS 
function  would  only  appear  on  the  other  elevon  resulting  in  half  gain  and 
coupling  into  roll.  However,  '"great  care  is  exercised  in  providing 
adequate  filtering  of  the  hydraulic  fluid  and  in  addition  all  main  metering 
spool  valves  are  designed  to  shear  any  metal  chips  that  might  get  by. 

Thixs,  the  probability  of  jamming  is  minimal.  The  yaw  axis  employs 
four  series  servos,  whiffle  tree  summed  in  psdrs,  with  each  pair  driving 
a separate  vertical.  The  roll  SAS  uses  two  series  servos,  one  for  each 
inboard  elevon. 

The  gain  scheduling  is  obtained  from  triple- redundant  differential 
pressure  sensors  and  altitude  switches.  These  are  not  part  of  the  Central 
Air  Data  Computer,  and  comprise  an  entirely  separate  but  simple  sensing 
package.  Because  of  the  high  reliance  placed  on  the  pitch  SAS  to  provide 
static  stability,  an  additional  backup  pitch  damper  (BUPD)  is  mechanized. 
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This  consists  of  a separate  pitch  rate  gyro  and  electronics  located  in  a 
controlled  environnaent  that  can  be  switched  into  either  the  A or  B servos. 
This  system  has  a fixed  gain  and  is  to  be  used  only  below  50,  000  feet 
and  at  subsonic  speeds.  To  date,  there  is  no  record  of  the  BUPD  ever 
having  been  used.  The  purpose  of  the  BUPD  was  only  to  provide  adequate 

handling  qualities  for  refueling  and  landing  in  the  event  that  the  basic  pitch 

SAS  failed  due  to  overheating  of  the  normal  pitch  gyros. 

Simple  block  diagrams  of  the  pitch,  yaw  and  roll  SAS  mechanization 

are  shown  in  Figures  2,  3 and  4.  It  is  seen  that  the  triplex  systems 

shown  for  the  pitch  and  yaw  axes  employ  a monitor  channel  whose  only 
function  is  to  provide  a reference  for  voting.  The  interceptor  version 
was  modified  in  that  all  three  channels  of  both  the  yaw  and  pitch  SAS  are 
active  contributing  one-third  of  the  total  command.  This  is  illustrated  in 
Figure  5 showing  the  yaw  SAS.  In  that  configuration,  when  the  voting 
logic  removes  a failed  channel,  the  gain  of  the  remaining  two  channels  is 
increased  by  a factor  of  1.5.  Override  provides  full  control  gain  from  a 
single  channel.  On  the  surface,  it  would  appear  that  the  availability  of 
the  additional  functional  channel  would  enhance  the  overall  reliability. 
However,  the  additional  mechanization  complexity  tends  to  offset  the  re- 
liability advantage. 

The  sensor  and  electronic  circuits  of  the  yaw  and  pitch  SAS 
utilize  triple  redundancy  in  such  a manner  that  a single  failure  is  fail- 
operational  with  no  change  in  system  performance.  This  is  achieved  by 
a voting  scheme  which  selects  the  "disagreeing”  channel  and  disengages 
it  as  shown  in  Figures  2 and  3.  A Second  or  third  failure  depending  on 
failure  sequence  results  in  total  disengagement  of  that  axis.  The  use  of 
tandem  servos  in  the  pitch  axis  eliminates  the  need  to  double  the  gain  in 
the  remaining  operational  channel  in  order  to  maintain  full  system  per- 
formance. However,  the  yaw  axis  electronic  gain  in  the  remaining 
operational  channel  is  automatically  doubled  to  maintain  performance 
because  of  the  whiffle  tree  surnrning  mechanization  of  the  series  servos. 

Only  two  channels,  A and  B,  are  functional;  the  M channel  is  used 
as  a reference  model.  After  total  disengagement  of  an  axis,  if  either 
the  A or  B channels  are  still  functional,  the  pilot  can  exercise  a logic 
override  switch  and  obtain  single  channel  performance. 

The  svervos  in  both  the  yaw  and  pitch  channels  are  essentially  quad- 
ruple, but  with  dual  hydraulic  supplies.  The  A hydraulic  supply  powers 
a right  and  a lef^  servo  that  are  both  being  driven  by  the  A electronics. 
The  B supply\  powers  the  remaining  two  servos  which  are  driven  by  the 
B electl^onics.  Th^xleft  and  right  servos  for  each  hydraulic  supply  are 
compared  and  |.f  they  fail  to  track,  that  channel  is  immediately  disengaged. 
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The  remaining  channel  with  its  associated  electronics  then  properly  con- 
trols both  the  left  and  right  surfaces  with  a gain  equivalent  to  that  of  the 
complete  system. 

The  failure  monitoring  logic  is  dual  redundant,  i.  e.  , each  compari- 
son is  independently  duplicated.  Since  a system  failure  upstream  of  the 
servos  produces  two  disagreements  in  the  voting  scheme,  a single  dis- 
agreement does  not  cause  a channel  disengage,  but  turns  on  the  M 
channel  warning  light.  A single  indicated  failure  of  servo  logic  will 
cause  the  related  servo  channel  to  disengage  and  turn  on  the  associated 
warning  light. 

The. roll  SAS  is  mechanized  as  a simple  dual  system  with  one 
channel  and  servo  for  each  side.  A cross -monitor  is  employed  in  the 
servo  feedback  loops  that  disengages  both  channels  in  the  event  of  dis- 
agreement. The  disengagement  is  indicated  by  a failure  light  between 
the  two  channel  switches.  Disengaging  and  reengaging  both  switches 
recycles  the  failure  logic  to  verify  the  failure.  The  pilot  then  exercises 
logic  override  by  switching  off  both  channels  and  manually  engaging  one 
channel  at  a time  to  test  and  select  the  operational  channel.  The  gain 
of  this  channel  is  automatically  doubled. 

Certain  types  of  servo  position  pickoff  failures  would  result  in  limit 
cycle  oscillations  which  would  not  be  detected  by  the  servo  logic.  There- 
fore, a separate  monitor  circuit  is  provided  in  each  servo  channel  to 
detect  open  and  short  circuits  in  the  pickoff  primaries  and  secondaries. 

In  order  for  the  pilot  to  evaluate  his  situation  in  the  event  of  failurt 
in  the  pitch  and  yaw  SAS,  a display  of  lights  is  presented  to  him  on  the 
Function  Select  Panel  located  on  the  right  console  as  shown  in  Figure  6. 

If  any  of  the  lights  are  on,  the  pilot  pushes  the  illuminated  buttons  to 
recycle  the  logic.  Should  this  fail  to  reinstate  the  channels,  the  pilot 
can  then  assess  his  situation  in  pitch  and  yaw  as  shown  in  Table  2 on 
the  assumption  that  the  light  indication  represents  the  first  failure.  Sub- 
sequent failures  use  tKiSi  same  lighting  sequence  and  as  a result,  the 
particular  type  failure  cannot  necessarily  be  isolated. 

One  of  the  major  contributors  to  the  maintenance  of  the  F-12  flight 
control  system  reliability  is  the  Mission  Recording  System  (MRS). 

Each  essential  parameter  of  the  various  vehicle  subsystems  is  monitored 
and  properly  signal  conditioned  for  use  in  a magnetic  tape  recorder. 

The  sampling  rate  for  each  parameter  is  once  very  three  seconds. 

During  the  interval  between  samples,  certain  of  the  more  signifi- 
cant parameters  are  monitored  by  peak-hold  circuits  which  are  reset 
when  sampled.  In  the  SAS  each  active  element  is  monitored.  This 
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includes  all  sensors,  gain  scheduling  devices,  amplifiers,  servos,  and 
logic.  This  is  then  made  use  of  in  two  ways.  The  first  is  obviously  fault 
isolation;  the  second  is  the  evaluation  of  logic  performance  during  system 
checkout.  For  the  latter,  the  pilot  exercises  the  SAS  logic  prior  to  each 
flight  and  then  again  as  soon  as  the  flight  is  terminated.  This  is  done 
by  activating  the  logic  checkout  switch  shown  adjacent  to  the  function 
selector  panel  in  Figure  6.  This  initiates  a preprogramed,  bviilt-in 
test  sequence  interrogating  all  SAS  logic  and  AFCS  disengage  functions. 
Careful  perusal  of  the  resultant  data  tape  then  reveals  the  status  of  SAS 
system  and  the  disengage  logic.  MRS  utilization  has  also  shown  that  it 
is  possible  to  detect  incipient  failures.  Although  it  is  possible  to  achieve 
this  through  use  of  special  software  in  the  data  processing,  this  has  not 
been  done.  Thus,  to  date,  this  type  of  examination  is  performed  visually 
by  the  data  reduction  technician. 


RELIABILITY  EXPERIENCE 

The  Honeywell  Corp.  was  subcontracted  to  provide  the  automatic 
flight  control  system  and  the  air  data  computer  (ADC).  The  design 
requirements  were  established  by  Lockheed.  Extremely  close  coordina«- 
tion  and  teamwork  between  Lockheed  and  Honeywell  was  maintained  in 
order  to  meet  the  design  goals  for  the  system.  How  well  these  design 
goals  were  attained  can  be  illustrated  by  the  experience  with  the  SAS. 
Honeywell  designed  and  built  the  nation's  first  triple-redundant,  fail- 
operational  SAS  for  the  F-12  series  aircraft  in  the  pitch  and  yaw  axes. 

In  the  thousands  of  operational  flight  hours  since  the  inception  of  the 
program,  the  pitch  and  yaw  SAS  has  suffered  only  two  functional  failures. 
One  was  a maintenance  error  where  incomplete  installation  of  the  rate 
gyro  packages  exposed  the  electrical  connectors  to  high  Mach  ram  air 
temperatures  resulting  in  loss  of  the  pitch  axis.  The  second  incident 
occurred  when  both  the  pitch  A and  B servos  failed  in  the  same  flight. 
There  were  other  instances  where  all  three  channels  were  simultaneously 
disengaged  due  to  power  transients  during  generator  failures  and  sub- 
sequent switchover  to  the  remaining  generator.  However,  the  channel, 
disengage  logic  was  immediately  recycled  and  the  system  functioned 
normally.  The  one  hardware  failure  during  operational  usage  can  be 
equated  to  a mean  time  between  failure  (MTBF)  approaching  150,  000 
hours  vs.  a predicted  MTBF  of  19,000  hours.  These  numbers  are 
based  on  total  system  operating  ground  and  flight  hours  in  an  operational 
environment  and  exclude  Category  I and  Category  II  flight  testing  since 
initial  testing  always  involves  some  problem  areas  and  system  modifica- 
tion. 
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CONCLUSIONS 


The  functional  reliability  of  the  F-12  aircraft  control  systems  has 
met  and  exceeded  all  expectations.  This  has  been  accomplished  even 
though  the  aircraft  and  many  of  the  control  system  components  must 
operate  in  the  mosl:  adverse  sustained  thermal  environment  experienced 
by  any  aircraft  in  the  world.  It  must  be  noted,  however,  that  the  system 
design  stresseti  reliability  through  simplicity.  This  resulted  in  minor 
compromise  of  handling  qualities  during  what  are  considered  transitional 
flight  Conditions.  This  would  probably  not  be  acceptable  for  commercial 
vehicles.  Thus,  for  such  applications,  more  elaborate  scheduling  and 
control  laws  would  be  required  placing  additional  burdens  on  functional 
reliability.  Although  the  F-12  flight  control  system  was  not  specifically 
designed  as  a fly-by-wire  system,  it  has  demonstrated  all  the  attributes 
that  are  required,  and  has  provided  a basis  for  the  development  of  pilot 
acceptance  of  such  sy sterns. 
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Table  I - Manual  Versus  SAS  Authority 


PERCENTAGE 


MANUAL  * AAANUAL 

AUTHORITY  SAS  AUTHORITY 
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Figure  1 - AFCS  Component  Locations 
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B-52  STABILITY  AUGMENTATION  SYSTEM  RELIABILITY 


T.  C.  Bowling  and  L.  W.  Key 
The  Boeing  Company , Wichita  Division 


SUMMARY 

The  B-52  SAS  (Stability  Augmentation  System)  was  developed  and  retrofitted 
to  nearly  300  aircraft.  It  actively  controls  B-52  structural  bending,  provides 
improved  yaw  and  pitch  damping  through  sensors  and  electronic  control  channels, 
and  puts  complete  reliance  on  hydraulic  control  power  for  rudder  and  elevators. 
The  system  has  now  experienced  over  300,000  flight  hours  and  has  exhibited  ser- 
vice reliability  comparable  to  the  results  of  the  reliability  test  program. 
Development  experience  points  out  numerous  lessons  with  potential  application  in 
the  mechanization  and  development  of  advanced  technology  control  systems  of  high 
reliability. 


j INTRODUCTION 

i 

The  B-52  SAS  (Stability  Augmentation  System)  was  developed  and  retrofitted 
on  nearly  300  aircraft  in  order  to  achieve  the  following  objectives: 


a.  Minimize  fatigue  damage  due  to  structure  deflection  in  turbulence. 

b.  Improve  capability  of  withstanding  extremely  high  velocity  gusts. 

c.  Improve  yaw  and  pitch  damping 

d.  Increase  rudder  and  elevator  authority. 

e.  Improve  crew  ride. 

It  was  necessary  to  place  unusual  emphasis  on  system  reliability,  for  two 
principal  reasons: 

a.  On  the  yaw  and  pitch  axes,  replacement  of  the  original  mechanical 
(servo  tab)  system  by  a hydraulic  actuator  system  introduces  the 
possibility  of  total  loss  of  rudder  and  elevator  control  in  flight  due 

to  hydraulic  failures. 

b.  The  use  of  an  electronic  system  with  relatively  high  rudder  and  elevator 
authority  introduces  the  possibility  of  sudden  unscheduled  displacements 
or  **hardovers*’  of  the  control  surfaces  due  to  electrical  faults,  with 
obvious  flight  safety  implications. 
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REDUNDANCY  MANAGEMENT 

Figure  1 Is  a simplified  schematic  diagram  of  the  SAS . Yaw  damping  and 
elastic  mode  suppression  signals  are  generated  by  combining  rate  gyro  outputs 
with  lateral  accelerometer  outputs,  and  the  gains  are  scheduled  according  to  air- 
speed (high  gain  at  low  airspeed  and  vice  versa) . For  the  pitch  axis,  only  rate 
gyro  signals  are  used;  the  gain  is  fixed  and  independent  of  airspeed.  There  are 
two  essentially  independent  hydraulic  power  supplies,  each  having  a main  pump  and 
an  emergency  pump.  The  main  pumps  are  electrically  powered;  the  emergency  pumps 
are  simply  hydraulic  transformers  (motor-pump  packages),  driven  by  separate 
existing  utility  hydraulic  systems  and  provided  with  flow  limiters  to  avoid 
crippling  the  utility  systems  in  the  event  of  loss  of  fluid  from  a SAS  system. 

The  control  surface  actuators  are  of  tandem  type,  normally  powered  by  both 
hydraulic  supplies . 

The  system  is  basically  FO-FS  (fail  operational  on  first  failure,  fail  soft 
on  second),  with  the  following  exceptions: 

a.  If  two  lateral  accelerometer  channels  fail,  all  three  accelerometer 
channels  drop  out,  while  the  yaw  axis  continues  to  operate  on  the  yaw 
rate  gyro  signals  only. 

b.  If  two  gain  scheduling  channels  fail,  all  three  channels  revert  to  a low 
gain  that  is  safe  at  all  airspeeds. 

These  two  features  provide  a substantial  decrease  in  the  number  of  two-failure 
combinations  that  can  cause  yaw  axis  disengagement  or  loss  of  function. 

The  basic  redundancy  management  concept  is  relatively  straightforward.  At 
various  points  in  the  three-channel  sensor-electronics  subsystem,  voters  and 
comparators  are  used,  as  shown  on  Figure  2.  For  example,  the  three  inputs  at  the 
left  of  the  diagram  may  represent  three  rate  gyro  outputs,  while  the  three  out- 
puts at  the  right  may  represent  three  channels  of  an  electronic  control  unit. 

If  any  input  disagrees  with  the  median  signal  by  more  than  the  preselected  error 
threshold,  the  comparator  trips  and  latches  itself  in  the  tripped  mode.  In  this 
mode,  the  comparator  swamps  the  discrepant  input  so  that  it  will  not  be  selected 
by  any  voter  as  a median  signal.  In  some  cases  the  swamping  signal  is  a hard- 
over;  in  other  cases,  it  is  a 400  Hz  square  wave.  Also,  the  comparator  shuts  off 
its  normal  "O.K.”  signal  to  the  logic  circuitry,  thus  preparing  the  logic  to  take 
proper  action  in  the  event  of  a subsequent  second  failure.  On  the  yaw  axis,  the 
failure  of  one  channel  also  sends  a ^channel  failed"  signal  to  the  pilot,  warning 
him  that  redundancy  has  been  lost  and  that  yaw  damping  will  be  automatically 
disengaged  in  the  event  of  a second  similar  failure.  Loss  of  yaw  damping  is  not 
a highly  critical  failure  mode,  but  it  poses  a slight  threat  to  flight  safety  by 
requiring  manual  damping  of  Dutch  roll,  which  may  be  difficult  with  certain  ad- 
verse combinations  of  high  gross  weight,  high  altitude,  poor  visibility,  and 
turbulence.  No  such  warning  to  the  pilot  is  required  for  single  channel  failures 
in  accelerometer,  gain  scheduling,  or  pitch  axis  channels,  as  these  pose  no 
threat  to  flight  safety  and  require  no  special  crew  action. 


762 


FLIGHT  SAFETY  RELIABILITY 


In  early  discussions.  Air  Force  representatives  expressed  a clear  desire  to 
state  the  system  reliability  objective  in  terms  of  aircraft  loss  rate.  This 
required  analysis  in  considerably  greater  depth  than  ordinary  reliability  calcu- 
lations for  a redundant  system.  It  was  necessary  to: 

a.  Define  each  potentially  critical  failure  mode  of  the  system  in  terms  of 
the  effect  on  control  surface  motions. 

b.  Compute  the  probabilities  of  occurrence  separately  for  each  of  these 
modes  during  each  phase  of  a standardized  mission  profile.  . 

c.  Compute  the  probability  of  aircraft  loss  for  each  mode  in  a variety  of 
flight  conditions  (altitude,  airspeed,  and  presence  of  nearby  aircraft 
such  as  in  aerial  refueling)  with  proper  allowance  for  probabilities  of 
various  turbulence  intensities  and  visibility  conditions. 

d.  Combine  the  above  to  obtain  a total  predicted  B-52  loss  rate  attribu- 
table to  SAS  failure. 


CRITICALITIES 

During  the  prototype  program,  hundreds  of  SAS  failures  were  simulated  in 
piloted  flight  simulators  and  the  resulting  aircraft  motions  were  recorded.  Five 
or  more  different  pilots  were  used  for  each  combination  of  SAS  failure  mode  and 
flight  condition.  After  each  simulation,  the  pilot  was  asked  to  estimate  the 
percentage  of  SAC  pilots  that  would  have  been  unable  to  avoid  loss  of  the  air- 
craft. The  results  were  averaged  to  arrive  at  a probability  of  aircraft  loss  for 
each  combination.  These  results  were  combined  with  the  probabilities  of  given 
turbulence  conditions,  visibility  conditions,  and  autopilot  status  to  yield  a 
criticality  matrix  suitable  for  use  in  the  aircraft  loss  prediction  program. 
Criticality,  as  used  here,  is  defined  as  the  probability  of  aircraft  loss  IT  the 
given  system  failure  mode  occurs  during  given  flight  conditions. 

In  the  past,  there  has  been  a widespread  tendency  to  treat  criticality  as  a 
dichotomy.  To  label  a failure  mode  as  ’Vcritical*’  meant  that  it  would  invariably 
cause  loss  of  the  aircraft,  and  to  label  it  as  ”non-critical”  meant  that  it 
would  never  cause  loss  of  aircraft.  In  other  words,  criticality  was  assigned 
only  two  possible  values:  zero  and  100  percent.  It  is  true,  of  course,  that  many 
failure  modes  have  criticalities  of  zero,  and  some  failure  modes,  such  as  gross 
failure  of  a primary  structure,  have  criticalities  of  100  percent.  But  in  any 
attempt  to  make  a realistic  prediction  of  the  flight  safety  reliability  of  a 
control  system,  it  must  be  recognized  that  many  of  the  failure  modes  will  have 
intermediate  criticalities.  They  may  approach  100  percent  with  unfavorable 
combinations  of  flight  conditions,  and  may  be  essentially  zero  with  favorable 
combinations  of  flight  conditions. 

The  probability  of  occurrence  of  each  potentially  critical  system  failure 
nio4e  during  each  phase  of  the  mission  was  computed  using  conventional  methods, 
but^with  certain  refinements  as  subsequently  discussed.  These  probabilities  of 
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occurrence  were  compiled  into  a failure  mode  occurrence  probability  matrix. 

Figure  3 is  a simplified  diagram  showing  the  principal  factors  entering  into  the 
construction  of  these  two  matrices.  The  two  matrices  are  constructed  and 
combined  in  a computer  program  to  predict  aircraft  losses. 

In  many  cases  it  was  found  that  the  criticality  of  a given  system  failure 
mode  was  not  necessarily  determined  by  the  mission  phase  or  flight  conditions  in 
which  the  failure  occurred,  but  by  subsequent  conditions.  Many  failure  modes 
are  relatively  noncritical  in  high  altitude  cruise,  for  instance,  but  leave  the 
system  in  a degraded  state  that  may  have  a much  greater  criticality  in  subsequent 
mission  phases  such  as  low  level  penetration  or  landing.  Since  high  altitude 
cruise  accounts  for  a large  portion  of  the  mission  duration,  most  of  the  failures 
will  tend  to  occur  during  cruise,  but  many  of  the  resulting  aircraft  losses  will 
occur  during  a subsequent  mission  phase.  For  other  failure  modes,  the  surprise 
factor  is  predominant;  the  probability  of  aircraft  loss  is  chiefly  dependent  on 
the  pilot’s  skill  and  corrective  actions  immediately  after  the  failure.  These 
considerations  were  taken  into  account  in  the  computerized  program. 


BITE 

The  system  includes  BITE  (Built-In  Test  Equipment)  which  serves  two  main 
purposes: 


a.  It  permits  a quick  preflight  checkout  to  determine,  as  far  as 
practicable,  that  all  components  in  all  channels  are  unfailed  before 
takeoff . 

b.  It  facilitates  diagnosis  by  identifying  the  failed  LRU. 

Neither  of  the  above  BITE  functions  is  achieved  with  100  percent  certainty. 

A careful  analysis  was  made  to  determine  which  failure  modes  of  which  components 
could  not  be  detected  by  BITE  or  by  any  feasible  preflight  check.  For  each  such 
’’hidden”  failure  mode,  suitable  ground  check  intervals  were  established.  Where- 
ever  a hidden  mode,  in  combination  with  other  component  failure  modes,  could 
produce  a potentially  critical  system  failure  mode,  the  computation  of  the 
probability  of  system  failure  mode  occurrence  was  based  on  the  established  ground 
check  interval  and  not  merely  the  time  since  takeoff.  This  makes  a significant 
difference  in  the  probability  of  a given  two-failure  or  three-failure  combina- 
tion, as  compared  to  the  conventional  method  of  computing  redundant  system 
reliability,  which  is  based  on  the  implicit  assumption  that  all  parts  are 
unfailed  at  takeoff. 


SNEAK  FAILURE  MODES 

In  addition  to  this  ’’hidden”  failure  mode  problem,  we  also  encountered 
several  ’’sneak”  failure  modes.  A sneak  failure  mode  may  be  roughly  defined  as 
one  which  produces  unexpected  effects  that  tend  to  negate  part  of  the  redundancy. 
Such  modes  exist  chiefly  because  of  inadequate  FMEA  (Failure  Mode  and  Effect 
Analysis) . For  example,  the  voters  used  in  the  -prototype  design  contained  two 
sneak  failure  modes.  In  one  of  them,  a single  voter  fault  would  produce  a 
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hardover  signal  on  all  three  channels  simultaneously.  In  the  other,  a single 
voter  fault  would  cause  a single  hardover  originating  upstream  to  be  propagated 
downstream  on  all  three  channels.  These  problems  were  corrected  in  the  produc- 
tion design. 

Another  fertile  field  in  which  sneak  failure  modes  typically  abound  is  in 
the  area  of  electronic  module  power  supplies.  Naturally,  the  three-channel 
redundant  configuration  of  the  electronics  and  sensors  employed  separate  power 
supply  modules  to  power  the  electronics  on  each  channel.  Here  again  sneak 
failure  modes  were  found.  For  example,  one  power  supply  module  failure  could 
disable  a channel  and  at  the  same  time  prevent  the  logic  circuitry  from  taking 
proper  action.  Such  modes  were  **designed  out"  wherever  they  appeared.  ^ 


FAILURE  MODE  AND  EFFECT  ANALYSIS 

As  might  be  suspected  from  the  above  remarks,  the  task  of  analyzing  failure 
modes  and  their  effects  was  of  paramount  importance  in  making  a realistic  flight 
safety  reliability  analysis  for  the  SAS.  The  FMEA  is  a traditional  task  that  is 
usually  called  for  in  reliability  programs,  but  the  output,  in  many  cases,  is  of 
little  value  in  realistic  computation  of  the  reliability  of  a redundant  system. 
Among  the  typical  shortcomings  are: 

a.  Excessive  emphasis  on  what  fails  rather  than  how  it  fails;  insufficient 
recognition  of  failure  modes  other  than  open  circuit  and  short  circuit. 

b.  Inadequate  definition  of  effects  on  the  system;  use  of  catch-all  phrases 
such  as  "loss  or  degradation  of  output";  phrases  such  as  "Loss  of  15  VDC 
power'^  without  any  attempt  to  describe  what  happens  to  the  system  when 
the  15  VDC  power  is  lost. 

c.  Endless  repetition  of  the  obvious  and  neglect  of  the  nonobvious. 

d.  Failure  to  explain  the  functioning  of  the  system  or  assembly  and  its 
components  so  that  the  FMEA  will  be  meaningful  to  personnel  not  highly 
familiar  with  the  design. 

e.  Inadequate  explanation  of  redundancies,  where  applicable;  failure  to 
recognize  that  while  two  assemblies  may  be  in  parallel  with  respect  to 
the  more  common  or  obvious  failure  modes,  they  may  be  effectively  in 
series  with  respect  to  less  obvious  failure  modes . 

Although  formal  FMEA  reports  at  the  assembly  level  were  generated  in  the 
SAS  reliability  program,  there  was  no  attempt  to  compile  a system-level  FMEA  in 
the  usual  format  which  is  not  well  suited  for  delineating  the  effects  of 
redundancies-.  Instead,  the  FMEA  was  effectively  combined  with  the  quantitative 
flight  safety  reliability  analysis  as  illustrated  by  Figures  4 and  5.  These 

figures  represent  two  of  the  system  failure  modes.  The  notations  f/Q,  f^n^  etc. 

4 V / U 

represent  hourly  failure  rates  of  the  various  subassemblies  in  the  applicable 
subassembly  failure  modes.  In  other  words,  they  represent  blocks  on  a series- 
parallel  block  diagram  or  a fault  tree.  Each  critical  system  failure  mode  has  a 
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separate  diagram  or  a separate  branch  on  a fault  tree,  with  blocks  representing 
only  those  failure  modes  of  subassemblies  or  components  that  contribute  to  the 
given  critical  system  failure  mode.  Notations  such  as  h^p  §67’  are  the 

applicable  mode  failure  rates  of  subassemblies  in  an  off-line  or  standby  status. 
W represents  the  probability  of  icing  conditions  that  would  incapacitate  a pitot 
head  with  a failed  heater.  The  symbol  H refers  to  J:he  300-hour  periodic  check 
for  pitot  system  leakage,  which  is  the  failure  mode  denoted  by  The 

notations  and  T2  refer  to  time  since  takeoff;  for  example,  if  a mission  phase 
starts  5.52  hours  after  takeoff  and  ends  7.52  hours  after  takeoff,  = 5.52  and 
T2  = 1.52.  Insofar  as  potentially  critical  modes  are  concerned,  the  FMEA  is  thus 

represented  by  a collection  of  critical  system,  failure  mode  formulations  similar 
to  Figures  4 and  5.  We  have  attempted  the  task  of  modifying  the  usual  FMEA 
format  to  make  it  useful  in  redundant  system  analysis,  but  are  not  satisfied 
with  results  to  date. 


Many  component  failure  modes  were  simulated  in  laboratory  tests,  in  order  to 
evaluate  failure  mode  effects  that  were  not  clearly  predictable. 


BLOCK  DIAGRAMS  AND  FAULT  TREES 

Series-parallel  block  diagrams  and  fault  trees  are  sometimes  thought  of  as 
two  different  techniques  for  redundant  system  reliability  analysis,  although 
when  properly  used  they  convey  identical  information.  The  chief  differences 
between  these  two  approaches,  as  traditionally  used,  are: 


a.  Blocks  on  the  fault  tree  generally  represent  events  or  specific  failure 
modes  of  components,  while  blocks  on  the  series-parallel  diagram  have 
sometimes  been  used  to  represent  the  total  failure  rates  of  components. 

b-  The  fault  tree  is  generally  constructed  beginning  at  the  top  or  system 
level  and  working  down  to  the  detail  or  functional  module  level;  with 
the  block  diagram,  there  is  a tendency  to  start  at  the  component 
level  and  work  up  to  the  system  level. 

In  the  B-52  SAS  analysis,  we  used  two  teams,  one  starting  at  the  top  and  working 
down,  and  the  other  starting  at  the  bottom  and  working  upward.  Comparison  of 
the  results  provided  a useful  cross-check  and  helped  to  minimize  the  chance  of 
overlooking  critical  combinations.  As  long  as  the  blocks  represent  specific 
failure  modes  of  the  modules  or  components,  there  is  no  significant  difference 
between  the  two  diagramming  techniques,  and  the  choice  between  them  is  reduced 
to  a matter  of  personal  preference. 


RELIABILITY  TESTS 

The  reliability  programs  for  both  the  prototype  and  production  contracts 
included  extensive  system  reliability  testing  in  general  accordance  with 
MIL-STD-781.  Ordinarily,  system  reliability  tests  are  conducted  primarily  for 
the  purpose  of  MTBF  measurement  or  verification  of  compliance  with  MTBF 
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requirements.  For  the  SAS,  the  system  tests  were  regarded  primarily  as  oppor- 
tunities for  failure  cause  analysis  in  order  that  corrective  actions  could  be 
initiated  at  the  earliest  possible  date.  It  is  almost  axlomatiG  in  the  industry 
that  the  first  MTBF  test  will  show  an  MTBF  of  about  one  tenth  of  the  predicted 
value.  (Maybe  we  were  just  lucky;  our  first  prototype  MTBF  test  on  the  SAS 
indicated  an  MTBF  of  about  one  fourth  of  the  prediction,  instead  of  one  tenth.) 
Most  of  the  failures  in  the  MTBF  tests,  as  well  as  in  the  flight  test  program 
and  operational  mockup  (”Iron  Bird”)  tests,  showed  clear  causes  in  a careful 
failure  analysis,  and  corrective  actions  were  initiated  for  the  subsequent 
production  articles . 

MTBF  testing  under  the  production  contract  was  divided  into  four  phases: 

Phase  A consisted  of  about  1800  hours  of  operation  on  an  incomplete  system  - 

partly  with  prototype  hardware  and  partly  with  early  production  (unquali- 

fied)  hardware. 

Phase  B involved  2000  hours  of  operation  on  early  production  hardware. 

Phases  C and  D involved  515  hours  each,  using  fully  qualified  production 
hardware. 

The  purposes  of  Phases  A and  B was  to  determine  where  reliability  improve- 
ments were  needed,  at  the  earliest  practicable  date.  The  purpose  of  Phases  C 
and  D was  to  demonstrate  attainment  of  the  required  MTBF. 

The  reliability  test  environments,  both  prototype  and  production,  included 
cold  soaks  and  operation  at  ambient  temperatures  up  to  71^C  (160^F).  Initially, 
the  prototype  test  included  periods  of  applied  vibration  at  33  Hz  and  2g 
amplitude.  Vibration  attempts  were  finally  abandoned  for  the  following  reasons: 

a.  This  low  frequency  was  not  found  to  produce  any  significant  effects  on 
equipment  failure  rates. 

b.  This  type  of  vibration  bears  practically  no  relation  to  the  vibration 
encountered  in  jet  aircraft. 

c.  Any  significant  increase  in  frequency  would  require  a totally  new  test 
setup.  The  supporting  jig  was  marginal  even  at  33  Hz. 


EFFECTS  OF  WEAROUT 

It  is  widely  assumed  that  scheduled  replacements  in  service  will  avoid  the 
occurrence  of  normal  wearout  failures.  MTBF  is  consequently  often  considered  as 
a function  of  random  failure  rates  only;  and  since  MTBF  is  customarily  demon- 
strated by  tests  that  typically  operate  each  specimen  lor  500  hours  or  less, 
normal  wearout  is  seldom  significant  in  MTBF  demonstrations.  As  a result,  we 
see  so-called  MTBF  values  of  10,000  or  even  50,000  hours  quoted  for  mechanical 
and  hydraulic  equipment  items,  based  only  on  their  ’'random”  failure  rates  under 
the  assumption  that  scheduled  replacement  will  avoid  normal  wearout  problems. 
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MTBF  In  service,,  however,  is  a distinctly  different  problem.  Scheduled 
replacements  are  seldom  specified  or  practiced  except  where  there  is  a clear-cut 
safety  implication.  As  a result,  the  effective  MTBF  on  such  equipment  is  often 
far  less  than  a pure  ^random  failure**  consideration  would  Indicate. 


SERVICE  EXPERIENCE 

For  this  reason,  we  kept  two  sets  of  books  on  the  SAS  MTBF  — one  set 
based  on  random  failure  rates  only,  and  the  other  including  estimated  normal 
wearout  effects.  Table  I shows  the  resulting  difference  in  predicted  system 
MTBF,  and  also  shows  the  failure  experience  in  service  for  calendar  years  1972 
and  1973.  The  following  conclusions  may  be  noted  from  this  table: 


a.  The  hydraulics  subsystem  shows  a distinct  rise  in  failure  rates  from 
1972  to  1973.  The  1973  rates  agree  closely  with  the  prediction  that 
includes  wearout  effects. 

b.  The  sensor-electroniGs  subsystem  shows  a decrease  in  failure  rates 
from  1972  to  1973,  in  spite  of  expected  wearout  effects  in  the  six 
gyros.  This  indicates  a mixture  of  'two  different  kinds  of  apparent 
infant  mortality  effects: 

(1)  The  usual  infant  mortality  experienced  in  electronic  equipment, 
in  spite  of  burn-in  prior  to  delivery. 

(2)  An  improvement  in  the  maintenance  organizations*  familiarity  with 
the  equipment,  resulting  in  better  repairs  and  fewer  unnecessary 
replacements . 

c.  Field  experience  on  the  system  as  a whole  agrees  closely  with  the 
prediction  that  included  estimated  effects  of  normal  wearout. 

The  last  two  columns  at  the  right  of  Table  I are  based  on  detailed  analysis 
of  two  field  data  samples  which  both  indicated  that  about  one  third  of  the 
reported  electronic  failures  might  be  attributed  to  trial-and-error  trouble- 
shooting or  other  diagnostic  errors.  This  situation  is  believed  to  be  improv- 
ing with  time  and  experience  gained  in  the  field. 

Table  II  shows  the  various  types  of  mission  reliabilities  experienced  in 
service  in  the  1972-1973  period.  There  were  no  corresponding  quantitative 
requirements  or  predictions. 

Table  III  shows  the  SAS  flight  safety  reliability  requirements  and  pre- 
dictions. The  predictions  were  calculated  both  with  and  without  normal  wearout 
effects.  There  have  been  no  losses  to  date  attributable  to  the  SAS.  There 
were  several  early  occasions  of  loss  of  one  hydraulic  power  supply  in  service, 
due  to  fatigue  failures  of  main  pump  rigid  discharge  lines  which  happened  to  be 
in  resonance  with  the  pump  pulsation  frequency.  Actually,  a similar  failure 
had  previously  occurred  in  system  reliability  testing,  but  no  importance  was 
attached  to  it,  since  the  test  chamber  space  limitations  required  the  use  of 
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plumbing  configurations  somewhat  different  from  those  of  the  aircraft.  The 
lesson  learned  from  this  experience  is  that  every  effort  should  be  made  to  use 
aircraft  plumbing  configurations  in  system  reliability  tests,  particularly  where 
there  are  conceivable  resonance  or  fatigue  problems. 

The  system  MTBF  tests  indicated  surprisingly  low  reliability  for  certain 
simple  widely  used  standard  or  semistandard  hydraulic  components  such  as  accum- 
ulators and  pressure  switches.  Although  corrective  actions  were  initiated,  the> 
field  reliability  experience  on  these  components  is  still  disapp'ointing. 

CONCLUDING  REMARKS 

The  next  few  years  will  see  extensive  development  of  electronic-hydraulic 
flight  control  systems  of  fly-by-wire  and  controls-conf igured-vehicle  types, 
performing  highly  essential  functions  and  with  extremely  high  reliability 
requirements.  The  B-52  SAS  program  has  provided  useful  experience  for  the 
development  of  such  systems,  and  has  demonstrated  the  need  for  close  attention 
to  the  following  considerations: 

• Optimization  of  redundancy  management. 

• Meaningful  Failure  Mode/Effects  analyses  with  particular  emphasis  on 
effects  of  redundancy  and  redundancy  management  and  on  early  detection 
of  possible  sneak  failure  modes.  References  1,  2,  and  3 all  provide 
useful  guides  for  failure  mode  effect  analysis. 

• Laboratory  simulation  of  failure  modes  to  verify  effects  and  serve  as 
an  added  guard  against  sneak  failure  mode  effects. 

• Piloted  simulator  programs  to  measure  pilot  reaction  to  failure  modes 
where  applicable,  under  various  visibility  and  turbulence  conditions. 

• Adequate  consideration  of  wearout  effects  in  mechanical/hydraulic 
components . 

• Quantification  of  system  failure  mode  criticalities  to  permit  better 
allocation  of  effort  and  redundancy. 

• Adequate  BITE  to  avoid  takeoff  with  possible  hidden  failure  modes. 

• Suitable  periodic  checks  for  detection  of  possible  hidden  failure  modes 
not  feasibly  detectable  by  BITE. 

• Proper  reflection  of  periodic  check  interval  in  reliability  predictions, 
for  modes  not  detected  by  BITE. 

• Adequate  BITE  fault  isolation  capability  to  facilitate  proper  system 
repair. 

• Definition  of  reliability  requireraents  for  supplier-designed  components 
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in  terms  of  failure  mode  effects  and  redundancy  management  as  well  as 
the  customary  MTBF  requirements. 


• Establishment  of  schedule  that  permits  adequate  reliability  testing  to 
find  areas  for  reliability  improvement  at  earliest  possible  time  before 
final  design  freeze. 

• Vigorous  failure  analysis  and  reliability  corrective  action  program, 
not  only  in  reliability  tests  but  also  in  other  test  areas  (qualifica-" 
tion,  iron  bird,  flight  tests,  etc.) 
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Figure  2.  - Typical  Voter-Comparator  Diagram. 
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Figure  3-  - Matrices  and  Loss  Predictions 


MODE  25.  MOMENTARY  RUDDER  HARDOVER  TO  SAS  AUTHORITY  LIMIT  OR  LESS,  GUT  OFF  BY  PROMPT  COMPARATOR 
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300  HOURS  FOR  f, 


TABLE  I 


MTBF  COMPARISONS 


FAILURES  PER  THOUSAND  FLIGHT  HOURS 

PREDICTIONS 
BASED  ON 
TEST  EXPERIENCE 

AFM-66-1  SERVICE  DATA 

ITEIVI 

COUNTING  ALL 
REPORTED 

COUNTING  2/3 
OF  REPORTED 

NO 

WEAROUT 

WITH 

WEAROUT 

ELECTRONIC 

FAILURES 

ELECTRONIC 

FAILURES 

1972 

1973 

1973 

S^NSOR/ELECTRONICS 

SUBSYSTEM 

5.077 

7.459 

9.756 

8.705 

6.504 

5.803 

HYDRAULICS 

2.553 

7.271 

5.306 

7.564 

5.306 

7.564 

MISCELLANEOUS 

1.697 

1.697 

0.601 

0.857 

0.601 

0.857 

SYSTEM 

9.327 

16.427 

15.663 

17.126 

12.411 

14.224 

MTBF,  HOURS 

107 

61 

64 

58 

81 

70 

M+BF  GOAL 

100 

— 

— 

— 

TABLE  II 


SAS  MISSION  RELIABILITY  COMPARISONS 


BASIS:  SAC  AIR  VEHICLE  PERFORMANCE  REPORTS,  1972  AND  1973 


ITEM 

RELIABILITY 

FLIGHT  RELIABILITY: 

PROBABILITY  OF  NO  FLIGHT  ABORT  DUE  TO  SAS 

99.96% 

PROBABILITY  OF  NO  SAS  FLIGHT  ABORT  OR  MAJOR 
DEGRADATION*  IN  FLIGHT 

99,58% 

DISPATCH  RELIABILITY: 

PROBABILITY  OF  NO  LATE  TAKEOFF  OR  CANCELLATION 
DUE  TO  SAS 

99.73% 

COMBINED  RELIABILITY: 

PROBABILITY  OF  NO  SAS  FLIGHT  ABORT,  MAJOR 
DEGRADATION,  LATE  TAKEOFF,  OR  CANCELLATION 

99,31% 

t 

^INCLUDES  LOSS  OF  PRESSURE  FROM  ANY  OF  THE  FOUR  PUMPS. 
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TABLE  III 

SAS  FLIGHT  SAFETY  RELIABILITY 


FLIGHT  SAFETY 
RELIABILITY 

AIRCRAFT  LOSS  RATE  DUE 
TO  SAS,  PER  10®  FLIGHTS 

GOAL 

99.999182% 

8.18 

PREDICTION  (NO  WEAROUt) 

99.999798% 

2.02 

PREDICTION  (WITH  WEAROUT) 

99.999508% 

4.92 

EXPERIENCE  TO  DATE 

NO  LOSSES 

NO  LOSSES 
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LOCKHEED  L-1011  AVIONIC  FLIGHT  CONTROL  REDUNDANT  SYSTEMS 


E.  O,  Throndsen 
Lockheed-California  Company 


SUMMARY 


Two  of  the  Lockheed  L-1011  automatic  flight  control  systems  - yaw  sta- 
bility augmentation  and  automatic  landing  - are  described  in  terms  of  their 
redundancies.  The  reliability  objectives  for  these  systems  are  discussed 
and  related  to  in-service  experience.  In  general,  the  availability  of  the 
stability  augmentation  system  is  higher  than  the  original  design  require- 
ment, but  is  commensurate  with  early  estimates.  The  in-service  experience 
with  automatic  landing  is  not  sufficient  to  provide  verification  of  Cate- 
gory III  automatic  landing  system  estimated  availability.  Component  reli- 
ability is,  however,  generally  tracking  expectation. 


IKCRODUCTlOjN 


The  L-1011  TriStar  has  been  in  airline  operation  since  April  1972  as 
one  of  the  cixcrent  generation  of  wide-body  jets.  In  service  at  present, 
there  are  about  8o  units  of  the  current  model  which  is  a short  to  medium 
range  airplane  that  cruises  typically  at  M =.85>  Hp  = 33jOOO  feet.  Maximum 

takeoff  and  landing,  weights  are  430,000  and  360,000  pounds.  Figures  1 and 
2 show  the  airplane  dimensions  and  flight  control  surfaces,  respectively. 

The  Avionic  Flight  Control  System  (AFCS)  of  the  L-1011  is  highly  redun- 
dant in  comparison  to  such  systems  of  the  previous  generation  of  aircraft. 
This  redundancy  to  a certain  extent  is  manifest  in  the  so-called  "cruise" 
autopilot  portions  of  the  AFCS,  but  this  was  more  or  less  a fallout  of  the 
need  for  high  redundancy  in  the  Category  III  Automatic  Landing  System  (ALS) . 
The  configuration  of  the  "cruise"  portion  of  the  AFCS  yaw  control  channel 
was  also  affected  by  this  Category  III  requirement. 

It  is  intended  in  the  following  discussion  to  provide  brief  descrip- 
tions of  the  automatic  yaw  cruise  control  system  and  of  the  automatic 
landing  system,  these  descriptions  to  provide  the  background  for  judging 
system  redundancy  in  comparison  to  other  systems  familiar  to  the  reader. 

It  is  further  intended  to  present  in-service  derived  data  describing  the 
reliability  of  these  two  systems  and  to  relate  this  experience  to  expec- 
tation. 
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AFCS  OVERVIEW 


The  complete  AFCS  including  Category  Ilia  automatic  landing  was  certifi- 
cated at  the  time  of  initial  airplane  FAA  certification  in  April  1972.  It 
has  been  subsequently  so  certified  by  Canada  (MOT),  Great  Britain  (CAA), 

Japan  (JCAB),  and  West  Germany  (LBA).  In  the  total  fleet  to  date,  there 
have  been  about  l60,000  revenue  flight  hours  accumulated  for  approximately 
80,000  flights. 

Briefly  the  AFCS  consists  of  four  subsystems: 

Stability  Augmentation  System  (SAS) 

Autopilot/Flight  Director  System  (APFDS) 

Speed  Control  System  (SCS) 

Flight  Control  Electronic  System  (FCES) 

The  components  which  comprise  the  AFCS  are  listed  by  subsystem  in 
Table  1.  For  total  systems  function,  these  components  interface  with  other 
airplane  elements  such  as  sensors-air  data,  attitude  references,  radio 
navigation  and  altimetry  systems,  electrohydraulic  and  electrical  flight 
control  servos,  flight  instrimients , control  panels,  etc. 

The  SAS  functions  include  yaw  damping,  turn  coordination,  runway  align- 
ment during  automatic  landing  and  automatic  steering  during  the  landing 
rollout . 


The  APFDS  provides  for  automatic  control  of  the  airplane  from  takeoff 
to  landing.  There  are  the  usual  modes  of 

Roll  and  Pitch  Attitude  Hold  with  Control  Wheel 

Steering  (CWS)  and  Turbulence  Configuration  Control 
Altitude  Select  and  Hold 
Vertical  Speed  Select  and  Hold 
Airspeed  Hold  on  Pitch 
Mach  Hold  on  Pitch 
Heading  Select  and  Hold 
VOR  and  Area  Navigation 
Localizer  Capture  and  Track 

In  addition,  there  are  the  common  axis  modes  of 
Approach 

Approach/Land  (Autoland) 

Go -Around 
Takeoff 

The  pitch  commands  for  Go-Around  and  Takeoff  are  derived  in  the  SCS  with 
Takeoff  being  a flight  director  mode  only. 
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The  SCS  autothrottle  modes  are: 


Airspeed  Select  and  Hold 
Stall  Margin  Control 

The  lattei?  is  primarily  an  approach/land  mode  which  uses  angle  of  attack  as 
the  basic  reference.  And  as  just  mentioned,  the  SCS  also  provides  for  the 
Go-Around  and  Takeoff  modes  using  angle  of  attack  as  a reference. 

The  FCES  provides  a number  of  functions  such  as  electrical  pitch  trim, 
Mach  trim,  Mach  feel,  stall  warning,  altitude  alert,  primary  flight  controls 
monitoring,  automatic  ground  speed  brakes  and  direct  lift  control.  All  of 
these  functions  operate  when  either  pilot  or  autopilot  is  in  control. 

With  these  descriptive  remarks  as  background,  further  discussion  is 
confined  to  the  SAS  cruise  control  system  and  to  the  Automatic  Landing 
System.  Each  of  these  systems  has  operational  availability/reliability 
requirements  which  we  shall  examine  and  relate  to  the  reliabilities  achieved 
in  service  use. 


STABILITY  AUGMEMTATION  SYSTEM  (SAS) 


System  Mechanization 

Figure  3 depicts  the  cruise  configuration  of  the  SAS.  Each  of  the  two 
yaw  computers  contains  two  computation  channels  that  output  identical  servo 
commands  to  an  in-line  monitored  electrohydraullc  servo.  Four  aileron 
position  transducers  and  three  rate  gyros  service  the  four  computation 
channels  of  the  total  system.  The  rate  gyros  provide  for  Dutch  roll  damping 
inputs  and  the  aileron  transducers  provide  for  turn  coordination. 

Figure  4 shows  one  channel  of  the  SAS  cruise  computation.  It  is  seen 
that  the  gains  are  scheduled  with  flap  position  and  the  gyro  path  has  the 
usual  low  frequency  washout  filter  plus  a high  frequency  cut-off.  The 
aileron  input  path  has  a limited  washout  to  remove  aileron  trim  effects 
and  in  addition  an  adjustable  dead  zone  such  that  turn  coordination  only 
comes  into  play  for  sufficiently  large  aileron  inputs.  The  passed  signal 
is  subject  to  gain  changing  to  match  the  gyro  channel  and  to  low  pass 
filtering.  The  voter  output  to  rudder  siurface  response  can  be  approximated 
by  a two  Hz  second  order  servo  for  small  amplitudes.  However,  the  primary 
control  surface  servo  is  severely  hinge  moment  limited  in  cruise  flight. 

It  is  noted  that  in  Figure  4 the  output  of  the  computation  comprises 
one  input  to  a voter.  The  other  inputs  are  derived  from  the  other  three 
computation  channels  of  this  dual-dual  mechanization.  As  one  would  expect, 
there  are  two  computations  and  two  voters  per  yaw  computer  with  two  voter 
outputs  required  to  drive  one  SAS  electrohydraulic  servo  as  depicted  in 
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Figure  5 • The  two  voter  outputs  provide  for  driving  the  EHV  colls  in  a 
push-pull  arrangement  with  two  sets  of  dual  monitors  acting  to  shut  off 
the  servo  loop  hydraulics  if  a fault  is  detected. 

There  are  also  monitors  in  front  of  the  voters  which  control  the 
signal  configuration  of  the  voter  inputs  as  shown  in  Figure  6,  This  figure 
illustrates  the  concept  whereby  the  monitors  eontrol  switching  logic  that 
substitutes  signal  ground  or  an  alternate  computation  for  a faulted  channel. 
Figure  7 shows  the  voter  input  crossfeeding  for  the  complete  dual-dual 
system. 

In  addition  to  servo  and  computation  monitors,  there  are  rate  gyro 
monitors  and  electrical  power  monitors.  The  latter  operate  into  the  servo 
engage  logic  while  the  former  monitors  operate  into  the  voter  switching 
logic. 


Design  Objectives  and  Performance 


The  function  of  the  cruise  mode  of  the  SAS  is,  of  course,  to  provide 
improved  Dutch  roll  dairg)ing  for  enhancement  of  passenger  comfort  and 
handling  qualities  , and  for  reduction  of  fin  loads  . This  reduction  of 
vertical  tail  loading,  in  continuous  turbulence,  due  to  the  action  of  the 
SAS  was  reflected  in  the  definition  of  limit  design  loads. 


Early  in  the  development  of  the  L-lOll,  the  effectiveness  of  the  SAS 
was  investigated  to  determine  performance  and  reliability  objectives  for 
the  SAS  from  a loads  viewpoint.  It  appeared  that  a minimum  damping  ratio 
of  0.3  and  a timewise  availability  of  Slio  were  modest  design  objectives 
that  would  yield  significant  load  reductions.  It  was  subsequently  found, 
however,  that  higher  damping  ratios  could  be  achieved  over  most  of  the 
climb,  cruise  and  descent  flight  regimes  as  seen  from  the  data  given  in 
Table  2.  Only  at  low  speeds,  where  effects  on  fin  loads  are  not  critical, 
are  the  damping  ratios  less  than  0.3* 

It  also  became  evident  that  a Slio  availability  requirement  was  a very 
conservative  estimate  of  system  reliability.  On  the  basis  of  guaranteed 
failure  rates,  the  single  channel  failure  rate  was  calculated  to  be  about 

10~2  per  hour  and  to  preclude  the  possibility  that  an  airplane  might  be 
flown  without  SAS  for  a protracted  period,  it  is  required  that  at  least 
one  of  the  two  channels  be  operative  for  dispatch.  Recognizing  that  for 
most  flights  both  channels  of  SAS  are  operative,  even  99-9^  timewise 
availability  would  appear  to  be  conservative. 

A complete  discussion  of  the  effect  of  SAS  availability  on  loads  is 
given  in  reference  (l)  from  which  Figure  8 is  taken.  This  figure  illus- 
trates the  definition  of  design  loading  for  vertical  tail  shear  with  0,  97^ 
and  100^  SAS  availabilities.  It  is  based  on  a mission  analysis  criterion 
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whereby  the  frequency  of  exceedance  of  a load  quantity  is  calculated  for 
operations  over  specified  design  flight  profiles.  The  turbulence  environ- 
ment as  statistically  described  for  each  segment  of  a profile  is  applied 
to  the  airplane/load  transfer  function  to  derive  exceedance  curves  (with 
or  without  SAS  operating)  for  each  segment.  The  segment  exceedances  are 
summed  over  the  total  of  all  profiles  to  determine  a load  vs.  frequency- 
of -exceedance  curve  for  the  mission. 

H 

It  can  be  seen  from  Figure  8 that  the  major  reduction  (—  = 0.70)  is 

realized  by  having  at  least  97^  availability  and  further  reduction  comes 

G 

less  readily  with  100^  availability  realizing  a ratio  of  — = 0.65.  These 

J? 

results  are  for  a fully  linear  system  and  saturation  effects  reduce  the 
benefits  somewhat.  In  summary,  however,  with  97^  availability  the  net 
reduction  in  fin  loading  is  better  than  25^  relative  to  what  it  would  be 
if  no  SAS  were  available. 

It  woxild  be  very  surprising  if  the  in-service  reliability  indicated 
a SAS  availability  of  less  than  99>9^*  Ttie  con5>onent  MUlSF  values  are 
tracking  guarantees  as  indicated  in  Table  3*  There  have  apparently  been 
only  five  con5>lete  in-flight  losses  of  SAS  and  a very  few  delays  as  a 
result  of  lack  of  immediate  parts  replacement.  These  instances  with  one 
exception  were  associated  with  dispatch  for  many  consecutive  flights  with 
a failed  confutation  channel.  The  number  given  above  for  in-flight  losses 
covers  a period  in  which  revenue  flight  hours  were  accumulated  with  an 
average  flight  time  of  two  hours.  We  believe  that  there  have  been  no  other 
instances  of  complete  loss  to  date , and  that  it  is  conservative  to  use  only 
that  period  for  which  detail  records  have  been  evaluated  in  estimating  the 
total  system  failure  rate.  On  the  basis  of  actual  total  in-flight  losses 
during  the  period  evaluated,  the  SAS  availability  woTild  be 

1 ^ (5  losses)  (-g-  average  flight  time) 
total  flight  hours 


or  about  99«98?^«  The  individual  SAS  channel  in-flight  failure  rate  was  also 
examined  and  it  was  found  that  6o  channel  failures  were  experienced  in  a 
30,000  flight  hour  (2 -hour  flights)  period.  This  indicates  a SAS  channel 
MTBF  of  1000  hours  which  is  commensurate  with  the  data  of  Table  3* 


SAS  Conclusions 


With  respect  to  the  yaw  stability  augmentation  system,  the  following 
conclusions  can  be  drawn: 

o 97^  availability  is  an  extremely  conservative  value  upon 
which  to  base  design  loads. 
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o With  current  technology  of  design,  manufacturing  and 
airline  maintenance,  single  channel  SAS  reliability 
should  be  adequate  to  support  fin  loading  design 
criteria  as  established  for  the  L-1011. 

o L-lOll  dual  channel  SAS  provides  fin  load  alleviation 
for  all  practical  purposes  equivalent  to  100^  SAS  avail- 
ability. 

AUTOMATIC  LAfflDING  SYSTEM  (ALS) 


System  Mechanization 

The  principal  elements  of  the  ALS  are  the  APFDS  and  SAS  and  their 
respective  sensors  in  the  configurations  established  with  the  Approach/ 

Land  (A/L)  mode  selected.  The  system  in  total  definition  includes  much 
more  than  these  units  but  these  have,  by  far,  the  most  effect  on  system 
reliability  and  availability.  Reliability  is  used  here  in  the  sense  of 
the  system  capability  to  complete  a landing.  It  relates  directly  to 
safety,  particularly  in  low  weather  minima  operations.  It  was,  of  course, 
the  Category  III  requirement  that  dictated  the  extent  of  redundancy  in  the 
ALS.  This  redundancy  is  depicted  in  some  generality  in  Figure  9 'tti® 
pitch  and  roll  control  axes.  Each  of  these  axes  uses  three  accelerometers 
(normal  or  lateral)  and  three  attitude  inputs.  Pitch  computations  use 
only  derived  pitch  rate;  roll  uses  both  attitude  and  roll  rate  signals. 

The  Autoland  Sensor  signals  are  glideslope  error  and  radio  altitude  for 
pitch  and  localizer  error  for  roll.  Only  two  each  of  the  Autoland  Sensors 
are  used  but  each  has  dual  outputs  with  high  integrity  self -monitoring. 

For  example,  the  probability  of  the  two  signals  from  one  C/S  receiver  being 
faulted  at  a critical  time  without  warning  is  less  than  lo"^* 

The  same  theme  of  APFDS  redundancy  is  carried  over  into  the  SAS  in 
the  A/L  mode  as  seen  in  Figure  10.  Here,  the  exception  is  that  only  two 
compass  systems  are  utilized  which  do  not  have  the  integrity  of  an  Auto- 
land Sensor.  The  redundancy  requirement,  however,  is  not  as  great  for 
yaw  control  as  it  is  for  pitch  and  roll,  (in  the  development  program, 
automatic  landings  with  no  automatic  yaw  control  have  been  demonstrated 
without  any  significant  effect  except  that  the  pilot  had  to  control  the 
rollout.)  The  compass  inputs  are  actually  compared  in  the  SAS  computers 
and  used  to  define  a reference  heading  error  which  is  memorized.  The 
compass  signals  are  switched  out  at  150  feet  and  integrated  rate  gyro  data 
is  used  from  there  to  touchdown.  (The  radio  altitude  signals  used  to 
control  this  function  are  omitted  from  Figure  10.)  During  this  time,  a 
maneuver  is  performed  whereby  the  aircraft  fuselage  is  aligned  with  the 
runway  and  a wing  down  is  held  against  crosswind. 

This  use  of  the  compass  points  out  the  difference  between  the  safety 
and  availability  aspects.  For  Category  Ilia  conditions,  the  align 
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capability  is  required,  at  present,  and  if  one  compass  system  fails  on  the 
approach  above  the  alert  height  (lOO  feet  for  U.S,  Carriers),  a missed 
approach  is  executed.  Safety  implications  are  minimal,  but  as  far  as  avail- 
ability goes  the  day  is  lost. 

As  would  be  expected,  the  fail-operative  pitch,  roll  and  yaw  (below 
150  feet)  mechanizations  closely  follow  that  as  depicted  in  Figures  5,  6, 
and  7 for  the  cruise  yaw  control.  Four  computation  channels  for  each  axis 
are  needed  for  the  fail-operative  condition  and  two  or  three  for  the  fail- 
passive  condition.  The  latter  configuration  is  acceptable  for  Category  II 
operations  while  the  fomer  is  required  down  to  the  alert  height  for  Cate- 
gory Ilia.  There  are  minor  differences  in  each  servo  control  and  monitoring 
mechanizations,  but  the  basic  concepts  of  Figure  5 are  applied.  For  Cate- 
gory III,  of  course,  it  requires  two  servos  per  axis  while  one  is  acceptable 
for  Category  II. 

Much  is  left  unsaid  about  other  subsystems  of  the  ALS,  such  as 

o Speed  Control  System 

o Automatic  Pitch  Trim 

o Direct  Lift  Control 

o AFCS  Mode  Progress  and  Warning  Indicators 
o Flight  Instrument  Systems 
o Hydraulic  Power  Sources 
o Electrical  Power  Sources 

In  the  interest  of  completeness,  however.  Table  5 is  given  to  provide  a brief 
summary  of  the  major  elements  of  the  total  ALS.  It  is  also  noted  that  a 
more  complete  description  of  the  AFCS  is  given  in  Eeference  2. 


ALS  Objectives  and  Development  BesilLts 


There  were  three  L-1011  program  objectives  with  respect  to  the  ALS. 


1.  Achieve  a Category  Ilia  certification  with  a 
system  having  the  potential  for  Category  Illb. 

2.  Develop  a maintainable  system. 

3.  Develop  a system  which  has  a reasonably  high 
availability. 

There  is  no  doubt  we  held  tenaciously  to  achievement  of  the  first  objective 
and  we  like  to  believe  we  have  done  the  same  with  the  other  two.  It  may 
not  have  always  been  apparent,  but  we  believe  we  are  tracking  fairly  well 
even  though  it  is  perhaps  too  early  to  have  all  things  proven  out. 

It  is  a fact  that  we  certified  for  Category  Ilia  with  the  FAA  on 
schedule;  but,  as  you  are  probably  well  aware,  the  manufacturer's  certifi- 
cation is  only  the  first  of  a series.  Each  operator  must  verify  its 
capability  to  use  the  system  to  the  satisfaction  of  the  same  regulatory 
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agency.  One  L-1011  operator  has  accomplished  this;  others  are  working  at  it. 
In  the  meantime,  we  are  beginning  to  look  toward  achieving  a Category  IlXb 
capability.  ' 

One  of  the  things  an  operator  must  show  to  achieve  an  ALS  certification 
is  his  ability. to  maintain  the  system.  An  indication  of  this  capability  is 
a comparison  of  failure  rates  achieved  with  those  used  in  the  Lockheed  certi- 
fication analysis.  In  effect,  MTBF  tracking  limits  are  defined.  Table  4 
shows  a list  of  MTBF  lower  limits  and  their  currently  estimated  values.  The 
data  given  in  this  table  are  for  the  significant  contributors  to  the  total 
disconnect  probability  (below  the  alert  height).  If  the  MTBF's  of  all  the 
listed  units  were  at  the  lower  limits,  the  total  disconnect  probability  would 
be  potentially  a factor  of  two  higher,  still  within  acceptable  limits.  These 
"lower  limits"  are  not  absolute  limits  in  view  of  the  fact  that  the  two 
factor  does  not  put  the  disconnect  probability  to  an  unacceptable  level  and 
further  one  low  MTBF  value  could  be  compensated  by  a high  one.  To  a certain 
extent  the  limit  is  a tracking  limit  to  signal  for  more  detail  examination  of 
a potential  trouble  area.  So  far,  however,  things  seem  to  be  tracking  fairly 
well. 


With  respect  to  ALS  availability,  there  is  very  little  data  to  display. 
The  one  airline  operator  that  has  received  a Category  Ilia  certification  has 
shown  in  his  initial  data  gathering  period  results  to  support  the  certifi- 
cation requirement.  The  reported  results  support  the  reliability  prediction 
but  do  not  allow  correlation  with  the  availability  estimates  of  Figure  11. 
This  figure  gives  a prediction  of  the  Category  Ilia  ALS  availability  as  an 
operational  day  (l4  hours)  progresses.  It  is  assumed  that  10  hours  are 
reserved  for  maintenance  and  that  the  ALS  is  apparently  restored  to  a fault- 
free  condition  by  the  start  of  each  day.  Mature  failure  rates  were  used  to 
make  the  prediction. 

The  curve  of  Figure  11  may  well  represent  an  upper  value  on  availability 
for  the  ALS,  but  at  this  time  we  cannot  say.  We  shall  find  out,  however,  as 
we  are  now  embarking  on  a program  for  evaluating  availability  in  cooperation 
with  one  overseas  operator.  And  we  feel  confident  that  the  system  will  prove 
out  well. 


ALS  Conclusions 


The  progress  with  the  L-1011  to  date  has  shown  that  certifying  and 
supporting  the  maintenance  of  a highly  redundant  automatic  landing  system 
can  be  accomplished  in  a scheduled  manner  much  like  any  other  flight  control 
system.  Further,  it  is  expected  that  future  progress  will  serve  to  demon- 
strate that  the  redundancy  and  complexity  will  not  detract  from  the  economic 
benefits  of  system  utilization. 
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Table  1.  - L-1011  Avionic  Flight  Control  System  Equipment  List 


Stability  Augmentation  System  (SAS) 

2 Yaw  Computers 

3 Rate  Gyros 

2 Aileron  Position  Sensors  (dual) 

2 Rudder  Position  Sensors  (dual) 

Autopilot /Flight  Director  System  (APFDS) 

2 Pitch  Computers 

2 Roll  Computers 

2 Pilot's  Control  Wheels 

2 Mode  Annunciators 

2 Warning  Indicators 

1 Mode  Select  Panel  (5  modules) 

3 Normal  Accelerometers 

3 Lateral  Accelerometers 

Speed  Control  System  (SCS) 

1 Speed  Control  Computer 

1 Autothrottle  Servo 

2 Longitudinal  Accelerometers 

Flight  Control  Electronic  System  (FCES) 

1 FCES  Computer 

1 Trim  Augmentation  Computer 

2 Angle  of  AttAck  Sensors 

2 Stick  Shakers 

1 Surface  Position  and  Pitch  Trim  Indicator 

10  Surface  Position  Sensors 

2 Control  Panels 
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Table  2.  - L-1011  Dutch  Roll  Characteristics  With  and 

Without  Yaw  SAS 

FLIGHT  CONDITIONS  (MID  CG)  ' 

DUTCH  ROLL  MODE 
DAMPING  RATIO  AND 
DAMPED  NATURAL  FREQ 

404 

UP  I 

UP 

308.5  ' 

■■ 

UP 

UP 

4oo 

UP 

UP 

350  , , 

UP 

■ 

UP 

300 

UP 

UP 

300 

UP 

UP 

350 

UP  ! 

..  UP 

300 

UP 

UP. 

300 

UP  ; 

1 : 

; UP 

308.5 

i UP 

UP 

308.5 

1 UP 

UP 

SAS  ON 


SAS  OFF 


t 
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Table  3«  - SAS  Reliability  Summary 

Item 

No.  Of 
Units 
per  SAS 
Channel 

No.  Of 
Units 
Per 

Aircraft 

Latest  Point 
Estimate 
MTBF  per  Unit 

Latest  MTBF 
Estimate 
@ 90^  Confid. 

Mature 

Unit 

MTBF 

Yaw  Computer 

1 

2 

10,900 

6,800 

4,600 

Rate  Gyro 

2* 

3* 

10,200 

6,300 

6,400 

Aileron  Position  Sensor 

1 

2 

— t 

47,100 

222,000 

Rudder  Servo 

1 

2** 

— t 

23,500 

24,000 

Control  Panel 

1 

2** 

— t 

23,500 

206,000 

Hydraulic  Source 

1 

2 

5,500/9,600 

3,300/4,800 

10,000 

Electrical  Source 

2* 

3* 

— t 

23,500 

167,000 

* One  gyro  is  shared  by  each  SAS  channel  as  is  one  electrical  source, 

**  Any  elements  common  to  both  SAS  channels  are  negligible  re  MTBF  estimates, 
t There  were  no  failures  in  reporting  period. 

Table  4.  - Estimated  MTBP's  vs  MUBF  Lower  Limits 

Item 

MTBF  Lower 
Limit 

Latest  MTBF 
Point  Est. 

Mature  MTBF 

Roll  Servo 

4,000 

* 

20,000 

Pitch  Servo 

..  2450 

* 

49,000 

Roll  Computer 

1,675 

1,800 

3,350 

Pitch  Computer 

1,350 

3,4oo  ' 

2,700 

Yaw  Computer 

2,300 

10,900 

3+765S 

ILS  Receiver 

1,750 

5,400 

3,500 

Radio  Altimeter 

1,750 

9,100 

3,500 

Vertical.  Gyro 

T7H5o 

5,200 

3,720 

Lateral  Accelerometer 

31,700 

** 

63,500 

Normal  Accelerometer 

31, 700' 

50oo 

Warning  Indicator 

9,600 

9,100. 

48,00^0 

Aural  Warnisag  Unit 

30,000 

V-  V \/ 
A A A 

150,000 

Hydraulic  Source 

2,000 

5,500 

10,000 

* No  reported  failures  in  5^ 
**  No  reported  failures  in  83 
***  No  reported  failures  in  2'i 

^ ^ ^ 

l-jOOO  servo  flight  hours. 

.,000  accelerometer  flight  hours. 

%000  flight  hours. 
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Table  5*  - Automatic  Landing  ^stem  Bfejor  Elements 


No. 

Item  Req. 

Pitch  Con5)uter  2 

Roll  Computer  2 

Yaw  Con5)uter  2 

Roll  a/p  Servo  2 

Pitch  A/p  Servo  2 

Yaw  A/p  Servo  2 

Aileron  Position  Sensor  2 

Rudder  Position  Sensor  2 

Yaw  Rate  Gyro  3 

ffode  Annunciator  2 

Warning  Indicator  2 

Mode  Select  Panel  1 

Normal  Accelerometer  3 

Lateral  Accelerometer  3 

Attitude  Gyro  3 

Radio  Altimeter  2 

ILS  Receiver  2 

Speed  Control  Coaputer  1 

Autothrottle  Servo  1 

Longitudinal  Accelerometer  2 

FCES  Computer  1 

DLC  Servo  2 

Trim  Augmentation  Con^juter  1 

Angle  of  Attack  Sensor  2 

Air  Data  Computer  2 

Altimeter  2 

IAS/M  Indicator  2 

VSI  2 

ADI  2 

HSI  2 

Radio  Altitude  Indicator  2 

Compass  System  2 

Hydraulic  Source  2 

Electric  Source  3 


Remarks 


Each  con5)uter  is  dual  channel. 


Each  servo  is  in-line  monitored. 
Each  sensor  is  dual. 

II  ll  If  It 

Each  has  limited  in-line  monitoring. 


Each  has  limited  in-line  monitoring 
Each  has  dual  outputs  with  high 
integrity  monitoring. 

Con^uter  is  dual  channel 
Servo  is  in-line  monitored 

Provides  for  fail-op/fail-pass  DLC 
Each  is  in-line  monitored 
Provides  for  fail-op/fail-pass 
auto  pitch  trim. 

Each  has  limited  in-line 
monitoring. 

Each  has  limited  in-line 
monitoring. 
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Figure  1 L-1011  General  Arrangement 


OUTBOARD 
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Figure  2 Control  Surface  Arrangement 


YAW  RATE 
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Figure  3 Stability  Augmentation  System-Cruise  Mode 
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Figure  4 Yaw  SAS  Cruise  Mode  Computation 
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Figure  6 Voter  Input  Switching 


Figure  7 Crossfeeding  of  Computation  Signals 


FREQUENCY  OF  EXCEEDANCE.CLYCLES  PER  HOUR 


Figure  8 Frequency  of  Exceedance  of  Vertical  Tail 
Shear  With  and  Without  Yaw  Damper 


99 


800 


Figure  9 APFDS  Approach/Land  Mode  Configuration 


SESSION  IX 


THE  ACT  TRANSPORT- 


PANACEA  FOR  THE  80’S  OR  DESIGNER’S  ILLUSION? 


Panel  diseussion 


Active  control  technology  is  being  promoted  as  a panacea  for  the  transports  of 
the  1980's,  reaping  performance  gains,  fuel  savings,  and  increased  return  on 
investment.  Are  these  projections  realistic  or  merely  designer's  illusions? 

A panel  discussion  was  held  at  the  symposium  which  attempted  to  make  an 
objective  and  pragmatic  assessment  of  the  standing  of  active  control  technology. 

The  discussion  focused  on  the  standing  of  active  control  technology  relative  to  civil 
air  transport  applications,  the  value  as  opposed  to  the  cost  of  the  projected  benefits, 
the  need  for  research , development , and  demonstration , the  role  of  government  and 
industry  in  developing  the  technology , the  major  obstacles  to  its  implementation , and 
the  probable  timing  of  the  full  utilization  of  active  control  technology  in  commercial 
transportation . 

The  panel  moderator  was  Joseph  Weil,  Director  of  Research  at  the  NASA  Flight 
Research  Center.  The  panel  meiribers  were  William  E.  Lamar,  Deputy  Director, 

Air  Force  Flight  Dynamics  Laboratory  ; Richard  P . Skully , Director , Flight  Stand- 
ards Services,  Federal  Aviation  Administration;  Arthur  J.  K.  Carline,  Manager, 
Advanced  Transport  Technology , Fort  Worth  Division , General  Dynamics  Corpora- 
tion; Clifford  F.  Newberry,  Director  of  Engineering,  Wichita  Division,  The  Boeing 
Company;  Franklin  W.  Kolk,  Vice  President,  Systems  Planning,  American  Airlines, 
Incorporated;  and  Lloyd  L.  Treece,  Vice  President,  Flight  Operations-Control 
Division , United  Air  Lines , Incorporated . 

The  following  is  an  edited  transcription  of  the  prepared  statements  of  the  panel 
members  and  the  subsequent  open  discussion  between  the  panel  and  the  audience. 

A list  of  attendees  is  presented  in  the  appendix . 

T.  L.  K.  Sinull:  Welcome  to  the  ninth  session  of  the  symposium  , which  is  a 
panel  discussion  on  the  topic  "The  ACT  Transport— Panacea  for  the  80's  or  Designer's 
Illusion?"  The  moderator  for  the  panel  is  Joseph  Weil,  Director  of  Research  at  the 
NASA  Flight  Research  Center . This  session  is  being  tape  recorded , and  a trans- 
cription will  appear  in  the  proceedings  . 

J.  Weil:  Some  of  you  may  feel  somewhat  perplexed  at  this  point.  You  may  be 
wondering  whether  active  control  technology  and  eontrol-configured  vehicles  are 


blank,  not 
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ready  for  general  application  to  advanced  transport  design  or  whether  they  are 
being  oversold . Another  question  is  whether  events  should  set  their  own  pace  or 
the  government  should  increase  its  support  of  this  technology . The  last  paper 
yesterday,  by  Dicl?  Holloway,  provided  an  indication  of  what  might  be  done  to 
exploit  the  new  concepts . 

This  morning  we  are  fortunate  to  have  on  our  panel  six  distinguished  visitors  ; 
who  will  give  us  the  benefit  of  their  experience . We  have  allowed  each  panelist 
the  option  of  using  10  minutes  to  express  any  general  views  he  might  have  on  the 
overall  topic  of  discussion , The  panel  will  then  focus  its  discussion  on  three  inter- 
related questions:  what  are  the  potential  payoffs  of  active  control  technology , what 
are  the  biggest  obstacles  to  its  implementation,  and  what  new  programs  are  needed 
to  expedite  its  use  in  commercial  transports . We  are  anxious  to  have  enough  time 
to  discuss  these  subjects,  because  we  feel  they  are  extremely  important.  At  the 
end  of  the  panel  discussion , we  will  accept  comments  and  questions  from  the 
audience. 

At  this  point  I would  like  to  introduce  Ken  Carline,  who  will  begin  the  discus- 
sion . 


COMMENTS  BY  PANEL  MEMBERS 


A.  J.  K.  Carline:  What  is  active  control  technology  anyway?  In  the  past, 
we've  always  been  sure  to  relate  advances  in  technology  to  the  way  they  affect  the 
airlines.  I'm  talking  now  in  the  context  of  this  particular  symposium,  which  is 
related  to  transport  aircraft,  although  we've  also  heard  some  discussion  of  fighters. 

The  payoff— what's  the  payoff?  I'm  not  sure  that  We  really  know  what  the  payoff 
is . We've  heard  about  taking  weight  out  of  the  wing  based  on  maneuver  and  gust 
load  alleviation  systems , but  then  we  have  a problem  with  fatigue,  and  we  have  to 
put  some  weight  back  in  because  now  the  wing  has  a fatigue  life  of  only  5000  hours 
instead  of  30,000  hours  or  something  like  that.  So  I'm  not  sure  that  all  the  money 
we've  spent  and  all  the  studies  we've  done  have  shown  a payoff  yet.  I think  we 
ought  to  determine  what  we  are  doing  with  active  control  technology— it's  got  to  pay 
off.  Nothing  I've  seen  yet  proves  that  there  is  a payoff.  We've  seen  General 
Dynamics  and  Boeing  and  Lockheed  comparisons , and  the  benefits  vary  from  1 per- 
cent to  12  percent,  which,  I think,  emphasizes  the  problem.  I think  we  ought  to 
spend  some  money  on  some  really  meaningful  studies , something  on  the  order  of 
$1  million  instead  qf  $10,000,  and  get  some  meaningful  answers  on  the  real  payoff . 
We  ought  to  get  the  airlines  in  the  act  as  well,  not  after  the  fact,  the  way  we  usually 
do . I was  rather  disconcerted  to  find  that  the  panel  organized  to  develop  design 
criteria  didn't  include  a member  of  the  airlines.  So  I think  we  ought  to  determine 
the  payoff.  I believe  there  is  one,  but  I'm  not  sure  how  much  of  one  it  is. 

The  other  thing  we  ought  to  look  at  closely  is  how  we  can  get  the  question  of 
reliability  sorted  out  . And  we  ought  to  think  about  how  we  could  certify  an  air- 
plane. Then  we  should  implement  active  control 'functions,  in,  say,  10  or  12  cargo 
airplanes  and  find  out  what  they  do  for  us . Maybe  putting  an  active  control  system 
into  a cargo  airplane  will  extend  its  fatigue  life  from  40,000  hours  to  60,000  hours. 
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At  the  same  time , I think  we  ought  to  have  a good  demonstrator  airplane  with 
active  control  functions , and  not  one  where  we  can  only  alter  the  wing  because  we 
can't  move  the  landing  gear  or  something,  as  with  the  JetStar,  We  mustn't  have  too 
many  restraints , or  the  answers  won't  be  meaningful.  I suggest  that  we  build  an 
airplane  with  a digital  fly -by -wire  system  with  no  mechanical  backup.  Incidentally, 
the  Concorde  has  flown  2700  hours,  in  monsoons  and  in  Alaska,  and  they  have 
never  had  a failure  which  would  have  embarrassed  them  if  they  had  not  had  a 
meehanicai  backup  system,  so  the  record  is  pretty  good. 

Finally,  we  should  take  a serious  look  at  flutter  suppression,  which  I think 
worries  people  quite  a bit . 

First , let  us  determine  the  benefits  of  incorporating  active  control  technology 
systems  individually  and  in  combination . We  may  need  different  combinations  for 
different  purposes.  For  a short  haul  we  may  need  one  combination,  for  a medium 
haul  maybe  another , because  they  have  different  and  sometimes  conflicting  require- 
ments . The  studies  should  include  detailed  maintenance  costs , where  this  is 
possible , and  equipment  redundancy  requirements . Then , if  the  studies  show  the 
systems  to  be  worthwhile , and  I don't  think  we've  really  demonstrated  that  yet, 
NASA  should  sponsor  two  programs . In  one , a technology  demonstrator  aircraft , 
for  example  a business  jet  with  minimum  restraints , could  be  fitted  with  the  most 
promising  active  control  functions  , including  a digital  fly-by -wire  system  , which 
I believe  to  be  the  most  promising . In  the  other  , a small  fleet  of  cargo  airplanes 
could  be  modified  to  incorporate  one  or  more  active  control  functions  in  order  to 
accumulate  a bank  of  reliability  and  maintainability  information  . These  programs 
would  prove  or  disprove  the  studies  we've  done.  I also  think  we'd  do  well  to  track 
the  record  of  the  Concorde  control  system . I talked  for  2 hours  with  maintenance 
people  last  week  , and  they  gave  me  a lot  of  information  that  showed  its  record  to  be 
good . They  hadn't  had  any  really  significant  failures . And  the  track  record  of  the 
equipment  was  pretty  good . I also  think  we  ought  to  do  a lot  more  research  on 
flutter  suppression . I think  we  are  a long  way  from  taking  material  out  of  the  wing. 
Perhaps  in  time , in  some  future  commercial  transport,  but  I don't  think  it  will  be 
the  next  one . 

R.  P.  Skully:  1 would  like  to  start  by  saying  that  the  FAA  anticipates  the  incor- 
poration of  active  control  technology  into  civil  transport  aircraft  with  confidence 
and  a sense  of  readiness.  I'd  like  to  mention  some  of  the  things  we  have  done  and 
are  doing  to  prepare  for  the  application  of  active  control  technology  and  control- 
configured  concepts  in  the  transport  airplanes  presented  to  the  FAA  for  civil  certi- 
fication and  commercial  operation.  First,  the  Federal  Aviation  Eegulations  have 
already  been  amended  to  accommodate  the  unprecedented  technological  advances  of 
the  decades  just  past.  For  example,  a few  years  ago  the  captain's  instruments 
were  really  kept  separate , and  when  integrated  systems  came  into  being , we 
amended  the  rules  to  require  that  their  design  be  such  that  the  loss  of  display  of 
information  essential  to  safety  in  flight  would  be  extremely  Improbable . 

In  addition , the  operating  rules  have  been  changed  to  recognize  inertial  naviga- 
tion systems  and  low  weather  minimum  landing  systems . In  both  cases , accuracy 
and  reliability  had  to  meet  stringent  criteria  before  we  would  approve  using  the 
equipment  in  operational  aircraft . Area  navigation  systems  of  varying  degrees  of 
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sophistication  have  been  accepted  into  the  national  airspace  system . Digital 
distance-measuring  equipment  has  been  taken  in  stride,  and  altitude  alerting  and 
many  other  systems  have  come  into  being  within  the  framework  of  the  existing  opera- 
tional and  airworthiness  rules . The  ground  proximity  warning  system  has  been 
certificated  and  is  being  used  today  in  some  transport  aircraft  . 

When  a new  aircraft  is  presented  for  FAA  certification , we  might  find  that  it  has 
flight  characteristics  or  design  features  that  were  not  envisioned  when  the  rules 
were  first  written . We  then  apply  what  we  refer  to  as  special  conditions  to  make 
certain  that  the  eurrent  high  level  of  safety  is  maintained  when  these  new  features 
are  incorporated . Eecognizing  that  our  regulations  do  not  always  reflect  the  state 
of  the  art,  we've  initiated  a new  system  of  periodic  airworthiness  reviews.  The 
last  such  review  conference  was  held  as  I recall  in  1960 . Over  1000  changes  to  the 
regulations  were  proposed  and  are  now  being  commented  on  by  all  interested  parties 
in  industry  and  government.  In  December  of  this  year  we  will  have  a public  meeting 
in  Washington , D . C . in  which  the  spokesmen  for  the  various  organizations  will  have 
an  opportunity  to  present  their  views . We  plan  to  have  a 2-year  cycle  to  minimize 
delays  in  implementing  amendments  to  the  regulations . This  airworthiness  review 
conference  is  being  scheduled  for  8 working  days , and  we  are  anticipating  many 
people  from  outside  the  United  States . 

Another  thing  we  are  proposing  is  the  introduction  of  flight  simulation  as  a 
substitute  for  a significant  portion  of  the  airworthiness  certification  process  . As 
most  of  you  know , we  have  already  authorized  the  use  of  approved  flight  simulators 
for  certain  pilot  certification  and  proficiency  requirements . The  simulator  will  be 
used  to  plan  and  practice  the  certification  flight  program  and  to  make  preliminary 
evaluations  of  new  aircraft,  so  that  critical  flight  conditions  can  be  pinpointed. 

Flight  tests  will  be  limited  to  the  validation  of  these  critical  conditions . This  will 
provide  a way  for  industry  to  test  its  ideas  against  FAA  standards,  and,  where 
appropriate , the  FAA  can  develop  new  standards  to  cover  new  aircraft  capabilities . 
This , in  turn , will  offer  industry  the  potential  for  creating  new  markets  and 
perhaps  prompt  international  competition . 

The  responsibility  for  developing  this  proposal  into  a successful  program  should 
be  shared  by  NASA , the  FAA , and  the  aviation  industry . The  role  NASA  plays  may 
be  to  provide  advanced  simulators  and  data  reduction  facilities . Automated  data 
processing  for  the  simulator  data  is  needed , of  course . In  addition , NASA  engi- 
neering support  could  help  the  industry  and  the  FAA  to  become  more  familiar  with 
NASA's  facilities  and  provide  a useful  exchange  of  research  information . Industry 
can  provide  a mathematical  model  for  the  vehicle,  validated,  if  possible,  by  proto- 
type testing.  Industry  could  also  be  responsible  for  the  bookkeeping  and  updating 
of  the  mathematical  model , provide  the  engineering  and  pilot  support  for  the  pro- 
grams , and  participate  with  the  FAA  during  the  simulator  tests . The  FAA  can  pro- 
vide engineering  and  pilot  participation  in  the  simulator  tests  of  the  vehicle's  math- 
ematical model  and  establish  the  requirements  for  aircraft  certification . Of  course , 
both  NASA  and  the  FAA  would  assume  responsibility  for  the  proprietary  rights  of 
the  industry . 

The  FAA  is  ready  to  pursue,  with  your  support,  new  areas  of  technology, 
including  new  applications  of  propulsive  lift , advanced  structures , synthetic 
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stability  , digital  controls,  and  other  new  designs.  We're  looking  forward  to  working 
with  all  these  groups  in  the  near  future , 

W.  E.  Lamar:  The  question  of  transitioning  technology  is , of  course,  of  consid- 
erable interest  to  people  at  the  Air  Force  Flight  Dynamics  Laboratory . The  only 
reason  the  laboratory  exists  is  to  develop  new  technology  and  see  that  it  is  applied. 

If  it  isn't  applied,  people  wonder  what  the  laboratory  is  for.  So  the  application  of 
new  technology  is  of  paramount  importance  to  us . 

In  answer  to  one  of  the  comments , I believe  we  have  made  progress . I don't 
mean  just  the  laboratory;  industry,  NASA,  and  this  nation  have  all  helped  to  develop 
the  basis  for  this  technology . Many  aircraft  that  incorporate  active  control  tech- 
nology are  actually  flying , demonstrating  a portion  of  the  technology  and  in  some 
cases  a significant  portion . The  YF-16  airplane  is  a brand  new  vehicle  which 
incorporates  a fly-by-wire  system  and  relaxed  static  stability . So  we  know  how  to 
do  it,  we  know  that  we  can  make  this  technology  work.  J 

There  are  several  questions  , however . First  , what  is  the  real  need,  and  what 
is  the  payoff?  Now  here,  I think,  there  is  a lot  of  room  for  work.  Ken  Carline 
brought  this  up , and  I couldn't  agree  with  his  remarks  more . Analyses  must  be 
made  in  depth  to  make  it  clear  that  there  really  is  a payoff  , and  that  the  payoff 
doesn't  vanish  when  you  get  to  the  suboptimization  that  results  when  you  look  at 
the  whole  system . You've  got  to  be  sure  that  the  payoffs  remain.  I remember  the 
Boeing  experience  and  the  supersonic  transport . They  considered  active  flutter 
suppression  using  the  flight  control  system . As  I remember , estimates  of 
9000  pounds  in  weight  savings  were  made  because  of  the  flutter  suppression  system. 
As  the  design  progressed  and  they  got  into  the  problems  of  the  total  system , a lot 
of  the  apparent  savings  vanished.  So  you've  got  to  make  sure  that  the  studies  are 
in  enough  depth  to  have  a total  system  viewpoint.  You  need  that  confidence. 

It's  likely  that  the  first  application  of  this  technology  will  be  to  provide  fixes 
for  current  aircraft.  The  C-5  airplane  is  an  excellent  example.  Studies  of  the 
application  of  load  alleviation  and  mode  stabilization  to  the  C-5  aircraft  were  made 
long  ago . At  that  time  there  was  very  little  need  for  that  technology . Now  it  is 
being  applied , and  I think  the  papers  by  Lockheed  showed  the  depth  of  the  studies 
necessary  to  find  out  the  best  way  to  apply  it.  Now,  if  the  application  of  active  load 
distribution  technology  improves  the  aircraft's  life  by  a factor  of  two  , the  improve- 
ment is  significant;  it's  a tremendous  payoff,  one  that  essentially  saves  an  airplane, 
because  you  fly  double  the  time , 

I think  that  there  are  a lot  of  cases  in  which  this  technology  will  be  used  to  fix 
problems , but  if  it  is  going  to  be  applied  to  new  aircraft  I think  we'll  have  to  have 
a crisis  of  some  type,  or  a national  need.  That  means  we  need  the  techi^ology  in 
hand,  ready  to  go.  The  space  program  got  started  because  of  the  Russian  sputnik, 
and  the  intercontinental  ballistic  missile  program  got  started  because  of  the  missile 
gap.  We  couldn't  get  any  money  for  structural  development  until  an  F-lH  wing 
fell  off,  and  then  we  ran  into  problems  with  the  C-5  airplane.  There  has  to  be  a 
crisis  of  some  type.  Sometimes  it  is  in  a safety  area  or  in  a C-5  type  of  area. 
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To  apply  this  to  the  airlines,  and  I must  say  to  the  Air  Force  too,  maintainabil- 
ity must  be  determined , because  overhead  and  maintenance  costs  are  taking  a big 
portion  of  the  total  dollars  available , If  this  keeps  up  we  won’t  have  any  money  for 
new  systems , so  we'll  have  to  do  something  about  insuring  maintainability.  We’ve 
got  to  make  sure  the  risks  and  uncertainties  are  understood  , that  there  are  no 
surprises  that  appear  after  we  fly  a number  of  months . This  has  happened  with 
many  aircraft,  like  the  T-tailed  aircraft,  for  example.  So  you've  got  to  know  what  ' 
the  costs  are , and  our  ability  to  ascertain  costs  in  advance  is  really  only  in  a 
beginning  stage.  People  don't  have  much  confidence  that  we  can  estimate  costs 
properly.  We  need  a thorough  study  to  do  that. 

Then  there's  the  question  of  criteria,  specifications.  Military  specification 
8785B  in  principal  provides  the  criteria  , but  there  is  a need  for  a specific  meeting 
on  reliability  requirements.  The  specifications  are  undergoing  revision.  I think 
what's  required  here  is  a concerted  effort  to  determine  acceptance  criteria.  There 
are  pretty  good  criteria  for  engines:  they  have  a 50-  or  60-hour  preliminary  flight 
rating  test  (PFRT) , and  if  an  engine  passes  that  test , it's  considered  adequate  for 
a new  airplane.  Later,  there's  a model  test,  which  is  more  thorough,  and  when  it 
passes  that  it's  ready  to  go  into  production.  Now,  because  of  some  engine  problems 
they  are  now  changing  the  engine  specifications  somewhat , and  trying  to  tailor 
them  more  to  the  usage  requirements  of  the  airplane.  We  need  to  do  the  same  thing 
in  the  flight  control  area.  We  need  to  understand  just  what  the  technology  people 
must  do  to  prepare  the  technology  for  transition . But  this  means  that  the  users 
have  to  get  together  with  the  certifiers  and  the  contractors  and  agree  what  kind  of 
proof  is  necessary  to  make  the  transition  in  the  technology.  Then  maybe  we  can 
start  filling  the  gaps , 

And  there  are  quite  a few  gaps.  For  example,  we're  still  not  sure  about  the 
effects  of  lightning  on  fly-by-wire  systems.  Right  now  we  do  not  permit  our  F-4 
fly-by-wire  airplane  to  fly  in  lightning . We  do  not  permit  the  YF-16  airplane  to 
fly  near  lightning  either . I'm  sure  that  as  the  program  proceeds  things  will  be 
done  to  determine  the  effects  of  lightning . These  are  unusual  problems , but  we’ve 
got  to  solve  them,  and  make  sure  we  are  completely  ready  for  operation.  We've 
got  to  get  clear  acceptance  criteria,  and  right  now  they  are  not  clear ., 

There  are  many  approaches  that  one  can  take  to  application , but  certainly  a 
fix-up  approach,  as  on  the  C-5  airplane,  where  the  technology  is  applied  step  by 
step  in  nonflight- safety  areas , is  the  first  step . For  example , when  gust  load 
alleviation  is  applied  and  it  works , you  get  gust  load  alleviation  and  you  save  some 
fatigue  damage . When  it  doesn’t  work , you  get  a little  more  fatigue  damage  on  one 
flight,  but  next  time  you  fix  it.  The  problem  is  to  make  sure  that  it  doesn't  screw 
up  some  other  system  and  interact  in  the  wrong  way  from  a flight  safety  standpoint . 
That's  a way  to  apply  the  technology  safely  and  get  experience.  Certainly  the 
Air  Force  is  getting  a lot  of  experience  with  command  augmentation  systems . They 
are  basically  the  same  as  fly-by-wire  systems.  They  work,  and  we  get  a good 
understanding  of  their  reliability , so  we  are  much  more  willing  to  go  to  full  depend- 
ence on  electronic  systems  . 

From  the  airline's  viewpoint,  I would  think  that  putting  a system  in  a nonpassen- 
ger cargo  airplane  might  be  a good  way  to  acquire  experience  with  the  technology . 
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Maybe  the  pilots  will  want  ejection  seats , which  is  different  from  normal  airline 
practice,  but  it’s  a way  to  get  lots  of  time  and  experience  with  the  technology  in  the 
airline  environment.  You  can  also  apply  the  technology  with  systems  that  have 
backups.  When  we  first  flew  the  F-4  fly -by -wire  flight  control  system,  it  did  have 
a mechanical  backup . After  flying  a while  we  had  enough  courage  to  take  it  out . 

So  keeping  the  backup  in  at  first  may  be  a way  to  build  up  enough  confidence  to 
take  it  out.  Later  on,  you  can  apply  it  to  completely  new  designs.  Again,  there 
ought  to  be  clear  acceptance  criteria.  I think  these  are  things  we  need  to  do. 

C.  F.  Newberry:  When  the  apostle  Paul  wrote  his  letter  to  the  church  of 
Corinth,  he  commented  that  they  compared  themselves  among  themselves  and 
commended  themselves . He  said  that  if  their  spiritual  life  was  as  good  as  they 
indicated,  it  should  have  affected  the  way  they  were  living.  I’ve  spent  2 days  at 
this  meeting  now,  and  I think  I have  somewhat  the  same  feeling.  As  we  compare 
our  technology  as  experts  among  experts  , we  should  ask  ourselves  why  we  aren't 
using  this  technology.  Dick  Holloway  addressed  this  question  a little  bit  yesterday, 
and  I’d  like  to  reconsider  some  of  his  comments  and  questions. 

First , we’re  faced  with  a balance  between  the  benefits  and  the  risks  of  this 
technology.  We  want  to  tip  the  scales  in  favor  of  the  benefits.  The  risks  are  safety 
and  economics.  From  an  airline’s  standpoint,  the  economic  risk  may  be  the  system’s 
reliability  and  maintainability . From  the  manufacturer’s  standpoint , the  risk  may 
be  product  liability  or  the  cost  of  retrofitting  a fleet  if  the  technology  is  introduced 
into  an  operating  fleet  prematurely . The  other  part  of  the  economic  risk  may  be 
letting  the  competition  get  ahead  of  you.  The  benefits,  of  course,  include  such 
:hings  as  lower  cost,  better  performance,  or  both. 


There  is  a decided  difference  between  the  acceptable  risk-to-benefit  ratio  for 
he  military  and  the  commercial  airlines . The  military  often  has  the  opportunity  to 
est  new  systems  in  prototype  airplanes  or  at  least  to  fit  the  system  into  an  experi- 
lental  situation  and  to  try  it  out  to  evaluate  the  risk  before  committing  itself  to 
roduction . This  is  not  generally  true  in  the  commercial  airlines , The  one  notable 
sception  to  this  is  the  Boeing  Model  367-80  (Dash-Eighty)  , which  introduced  the 
-707  fleet.  There  again,  it  was  a high  risk,  high  payoff  situation.  Therefore,  it 
important  for  the  risk  to  be  minimized  before  introducing  new  technology  into 
mmercial  aviation  and  expecting  it  to  be  accepted. 

We’ve  reviewed  various  aspects  of  active  control  technology  in  the  last  couple 
days , and  all  of  us  can  draw  our  own  risk  curves . There  are  different  levels  of 
k for  different  concepts . The  noncritical  aspects , such  as  load  alleviation , 

Igue  reduction,  and  ride  control  are  pretty  well  accepted.  I think  the  risk  of 
poducing  these  would  be  low . If  there  is  a problem , the  airplane  can  recover 
ely  after  it  is  switched  out  of  the  system . What  little  reduction  we  might  have  in 
gue  life  during  landing  would  be  of  no  consequence . 

The  fly -by -wire  and  stability  augmentation  systems  are  a bit  more  risky . I 
ik  the  date  of  application  depends  on  whether  the  application  is  military  or 
mercial.  I would  like  to  congratulate  General  Dynamics  for  applying  a fly-by- 
5 system  to  the  YF-16  airplane.  If  they’re  successful,  the  next  military  applica- 
will  be  a lot  easier . If  they  ’re  not  successful  , it’s  back  to  the  drawing  board 
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for  all  of  us . But  I might  remind  you  that  on  many  of  the  commercial  airplanes  some 
of  yoU(  will  be  going  home  on,  the  system  is  "fly-by-fluid,”  and  that  of  course  was 
not  too  acceptable  a few  years  back , The  flutter  mode  control  system  is  in  a more 
experimental  stage,  and  I think  we  will  have  to  do  much  more  work  in  this  area, 
looking  at  explosive  flutter  and  other  aspects  , before  it  will  be  accepted. 

Not  only  does  our  technology  need  to  be  developed  but  we  need  to  understand  > 
its  applications  . We  have  the  ability  to  evaluate  the  performance  benefits  of  the 
concepts  we  can  flight  test . The  benefits  of  the  concepts  are  configuration  sensi- 
tive, but  we  have  a reasonably  good  ability  to  flight  validate  them.  However,  when 
it  comes  to  the  ability  to  make  predictions  on  the  basis  of  preliminary  design  tech- 
niques, we  come  up  rather  short  . You’ve  heard  discussions  of  the  ability  to  repre- 
sent airplane  structural  modes  for  paper  airplanes  or  for  newly  designed  and  intro- 
duced airplanes.  Well,  I don't  share  quite  all  the  pessimism,  but  I do  think  that  we 
need  to  do  more  work  in  this  area . 

What  I feel  is  lacking , however , is  persuading  the  designer  to  take  full  advan- 
tage of  these  concepts . Ask  how  many  rivets  a designer  leaves  out  of  an  airplane 
because  he  has  an  active  control  system . Or  how  much  thinner  he  is  willing  to 
make  the  lower  wing  skin  because  maneuver  load  control  is  available  to  him . Our 
experience  to  date  is  that  active  control  technology  has  been  used  like  Band-Aids , 
We've  been  willing  to  patch  up  the  deficiencies ’of  existing  airplanes  by  using  some 
of  these  concepts . A history  of  active  control  technology  applications  over  the  past 
10  years  includes  the  B-52  airplane,  which  had  a stability  augmentation  system 
that  was  developed  in  1964.  The  B-52  airplane  was  designed  as  a high  altitude 
bomber.  In  1958  it  was  given  the  role  of  flying  low , and  it  didn't  take  it  very  long 
to  develop  a fatigue  problem.  Now,  this  stability  augmentation  system  was  designed 
to  alleviate  part  of  that  fatigue  problem,  a Band-Aid,  if  you  will.  We  generally 
refer  to  this  system  as  the  ECP-1195  system.  That  system  started  at  the  same  time 
as  or  slightly  before  the  research  program  called  load  alleviation  and  mode  stabili- 
zation, and  there  is  a 7-year  period  from  the  time  the  program  began  until  load 
alleviation  and  mode  stabilization  was  incorporated  in  a fleet.  Now,  perhaps 
finishing  the  research  a little  earlier  would  have  reduced  the  time;  however , we 
saw  from  Tom  Disney's  report  that  it  is  taking  several  years  to  incorporate  active 
controls  in  the  G-5  airplane.  And  again  it  is  a case  of  patching  up  a deficiency  , a 
Band-Aid. 

We've  also  had  intensive  research  for  10  years  in  the  area  of  active  flight 
controls  or  control-configured  vehicles.  On  Tuesday  Dr.  Kurzhals  showed  bar 
charts  indicating  that  research  in  active  control  technology  would  take  another 
8 years,  and  if  so  I question  the  idea  that  we're  on  the  threshold  of  a revolution. 
Instead,  we're  just  continuing  an  evolutionary  process,  and  maybe  that's  the  way 
it  ought  to  be . However , if  it's  true  that  we  require  an  additional  8 years , I think 
we  ought  to  change  our  acronym  from  CCV  for  control-configured  vehicles  to  CCC 
for  creation  of  control  careers.  Perhaps  I'm  being  a little  unfair  or  impatient  in 
wanting  to  get  on  with  it , but  I believe  that  NASA  has  an  important  role  in  bringing 
active  control  technology  into  usable  shape . 

Dick  Holloway  mentioned  yesterday,  and  I'd  like  to  reiterate,  that  we  need  an 
airline  type  of  airplane  to  fly  with  these  concepts  incorporated  in  it . It  should  fly 
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an  airline  route,  and  it  should  be  subject  to  the  same  conditions  the  airlines  are 
subjected  to  each  day.  1 don't  feel  that  this  would  be  exorbitantly  expensive.  I 
think  it  would  be  research  money  well  spent  . I've  heard  comments  on  various  ways 
to  bring  this  about , and  I think  we  ought  to  consider  some  of  these  and  investigate 
this  way  to  spend  some  of  the  research  money.  The  other  area  I'd  like  to  suggest 
that  NASA  do  some  research  in  was  mentioned  by  others , including  Dr . Perkins , 
and  that  is  preliminary  design.  So  let's  create  a real  design,  using  some  of  these 
concepts.  So  I say  to  NASA,  you  get  the  money,  we've  got  the  ideas. 

F.  W.  Kolk:  1 think  economics  is  the  key  to  all  this.  We've  got  to  have  a pay- 
off. We  have  to  have  not  only  a predictable  but  an  achievable  payoff  . The  airline 
community  has  been  enamored  of  a number  of  things  that  have  had  a great  effect  on 
our  airplanes  but  which  in  some  cases  have  had  a rather  indifferent  payoff.  One 
example  of  that  is  the  all-weather  landing  system . If  we  think  about  it , the  all- 
weather  landing  system  has  been  worthless  so  far . That  isn't  to  say  it  won't  be 
worth  something  some  day , but  the  admission  price  has  been  fantastic  and  the  show 
hasn't  started  yet,  so  to  speak.  We  can't  afford  another  debacle  like  that.  So  let's 
figure  out  what  our  real  payoffs  are  and  be  sure  that  we  get  them  and  be  sure  that 
we  don't  spend  too  much  money  getting  them . 

Acceptance  is  another  problem.  In  some  sessions,  people  calculated  the  basic 
system  reliability  to  be  somewhere  between  10“®  and  lO“®  (failures  per  flight  hour) . 
Keep  in  mind  that  the  loss  of  the  airplane  is  at  the  other  end  of  this  probability  , 
thing.  I think  I also  heard  Dick  Sliff  say  just  a few  minutes  ago  that  the  FAA  is 
thinking  in  terms  of  10“^®  for  this  sort  of  thing.  It  seems  to  me  that  our  airworthi- 
ness code  is  somewhere  on  the  order  of  10“®  to  10“’ . It  has  been  a long  time  since 
we  were  on  the  airworthiness  circuit  and  had  to  learn  probability , but  I think  those 
are  the  correct  numbers  . 

Now  maybe  we're  at  10“®  , but  maybe  from  experience  the  FAA  is  right  and  we 
need  10“^® . It's  a long  way  from  10”®  to  10”“  . This  is  going  to  be  a probability 
game.  Now,  when  we  have  probability,  we  have  several  problems.  One  of  them  is 
that  we  have  a bunch  of  airplane  drivers  and  they're  not  much  interested  in  proba- 
bility. They  haven't  really  been  schooled  in  it  as  a discipline  . All  they  want  to 
know  is  whether  it  will  happen  or  won't  happen  on  an  absolute  basis;  they  don't 
want  to  be  dead . I think  we  could  cause  them  quite  a bit  of  concern  with  this  kind 
of  thing  . 

Then,  of  course,  there's  the  business  of  the  accuracy  of  the  predictions.  If 
you're  going  to  have  a system  in  which  somebody  comes  up  and  puts  a chart  on  the 
wall  and  says  it  has  a reliability  of  10”^®  , how  does  he  know?  How  can  he  prove  it 
without  spending  20  years  testing  the  components  to  get  failure  rates?  When  you 
have  failure  rates  like  this , it  implies  that  you  either  have  a lot  of  junk  in  the  air- 
plane with  some  pretty  complex  interreactions  to  protect  against  failures  or  you've 
got  things  that  are  so  reliable  that  it's  not  in  your  ability  to  create  a failure  within 
your  lifetime,  I think  we  have  a problem . 

Then,  of  course,  there  is  the  infant  mortality  problem— what  happens  in  the 
first  500  hours  or  600  hours  after  the  introduction  of  a device  into  airline  service 
when  all  of  a sudden  it  doesn't  work . Maybe  the  airline  people  will  understand  it 
and  maybe  they  won't,  but  we've  had  to  live  through  a few  of  these  clambakes. 
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Well,  it's  not  all  bad.  We've  been  sneaking  up  on  active  control  technology  for 
quite  a while . Somebody  said  we've  been  flying  by  fluid  for  years , and  we  have . 
We've  been  flying  airplanes  around  with  increasing  amounts  of  power  boost  to  the 
point  where  they're  really  totally  powered  now . The  difference  between  power 
boost  and  fully  powered  controls  is  simply  the  feedback  ratio  to  the  pilot . When  it 
becomes  infinite , the  pilot  can't  do  anything  anyway  if  something  happens , There 
are  a lot  of  airplanes  flying  with  manual  reversion  provisions . But  if  a pilot  ever 
has  to  revert  to  manual  control , he  has  a pretty  limited  flight  envelope . So  we've 
already  faced  that  problem,  although  we  haven't  called  it  fly  by  wire. 

Another  problem  is  psychological.  The  airline  community  has  been  brought  up 
on  hard-earned  truths  that  were  learned  in  the  DC-3  era  or  with  early  DC-4  air- 
planes or  during  World  War  II . In  those  days  something  was  reliable  if  it  was  a bar 
of  iron  or  a thick  steel  cable  . If  you  wanted  to  have  something  not  quite  as  good  as 
that  but  with  more  muscle , you  made  it  hydraulic . That  was  somewhat  less  accept- 
able. If  you  really  wanted  to  get  fancy  and  stick  your  neck  out,  you  made  it  elec- 
tric , but  the  last  thing  you  did  was  make  it  electronic , because  everybody  knew 
that  wasn't  going  to  work  and  it  didn't.  Now  it's  30  years  later  and  it  seems  that 
the  order  of  the  reliability  of  those  things  has  reversed . But  most  people  in  the 
airlines  haven't  found  that  out  yet.  We've  got  an  education  problem. 

Then  you've  got  the  syndrome  in  which  here's  the  technology  looking  for  a 
mission.  I think  that  several  of  our  panel  speakers  have  touched  on  that.  I don't 
know  what  you  do  with  active  control  technology , I mean  I think  what  you  do  is 
disconnect  the  pilot  mechanically  and  fly  through  an  electrical  system , which 
sounds  pretty  good  , but  I don't  know  what  the  benefits  are.  The  full  benefits  will 
only  come  out  in  a totally  new  vehicle  design , and  this  totally  new  vehicle  design 
is  going  to  be  pretty  hard  to  come  by . Commercial  aviation  won't  be  able  to  afford 
any  kind  of  totally  new  vehicle  design  for  a few  years.  So  since  we're  not  going  to 
have  an  immediate  chance  for  a full-scale  application , I would  say  you  have  to  slug 
it  out  and  find  out  what  you  can  on  an  interim  basis , Band-Aids  if  you  will , and 
keep  on  making  improvements . 

L.  L.  Treece:  When  Joe  asked  me  to  appear  on  this  panel,  he  asked  me  if  I 
wanted  to  prepare  a 10-minute  speech.  I said  I thought  I'd  do  everybody  a favor 
and  not  prepare  a speech.  I do  have  some  thoughts  on  what  I've  seen  here  in  the 
past  few  days,  though.  First,  I'd  like  to  repeat  that  those  of  us  from  the  business 
end  of  the  airplane  are  interested  primarily  in  safety  of  operation  and  the  creation 
of  enough  redundancy  to  insure  that . Of  course , to  prove  this  we  need  an  adequate 
test  program . In  addition , the  economic  consideration  is  all  important  to  the 
industry . Some  things  have  been  presented  here  that  look  very  appealing  from  an 
economic  standpoint . Much  work  has  been  done , and  I think  we've  come  a long 
way  already  insofar  as  pilot  acceptance  is  concerned.  We've  seen  a degree  of 
acceptance  in  the  Caravelle  , B-727,  B-747,  and  other  airplanes  of  the  fluid  line  with 
the  controls  instead  of  the  cable  we're  used  to . And  as  far  as  the  acceptance  of  fly 
by  wire  with  the  control  wheel  steering  and  so  on  is  concerned  , I don't  think  we'll 
have  any  difficulty  selling  it  to  the  pilots  once  the  safety  aspects  are  proven . I 
don't  know  too  many  airlines  that  are  going  to  put  ejection  seats  in  a $25  million 
investment  to  launch  three  pilots , who  don't  want  to  go  anyway  under  those  condi- 
tions , into  the  air  to  test  a system . We're  going  to  have  to  find  a better  way  to  do 
it  than  that . 
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PANEL  AND  OPEN  DISCUSSION 


Weil:  What  I would  like  to  discuss  first  is  the  application  of  active  control  tech- 
nology to  a medium-  to  long-haul  conventional  transport  aircraft . 

Kolk:  I believe  that  there  will  be  great  tangible  benefits  in  incorporating 
active  control  technology  to  these  aircraft  . The  performance  of  the  airplane  will 
improve  and  therefore  fuel  consumption  will  decrease  because  the  center  of  gravity 
will  be  back  where  the  horizontal  tail  helps  rather  than  hinders . This  implies 
flying  some  unstable  airplanes  and  also  implies  putting  the  landing  gear  back  where 
the  airplane  won't  go  over  on  its  back  when  it's  taking  off  or  sitting  on  the  ground. 
Certainly  this  is  of  paramount  importance  if  we're  ever  going  to  have  a supersonic 
transport.  So  I think  I would  make  that  an  objective,  probably  an  initial  objective. 

I think  the  other  possible  objective  is  to  take  weight  out  of  the  wing  by  using  a 
system  for  load  relief  , I think  this  is  where  a failed  system  will  be  a big  problem , 
You  can  actually  fly  an  unstable  airplane , provided  that  it  doesn't  get  too  unstable 
statically , but  it's  pretty  difficult  to  fly  an  airplane  without  a wing  because  some- 
thing electric  has  failed  . I would  put  that  order  of  priority  on  it  . 

Car  line:  1 think  without  question  relaxed  static,  stability  and  fly-by -wire 
control  systems  should  be  considered  for  the  next  airplane , possibly  with  backup 
systems.  Then,  possibly  at  the  same  time,  I think  there's  a case  for  improving  the 
fatigue  life  of  the  airplane  . We've  had  a lot  of  cracks  in  airplanes  that  have  cost  a 
lot  of  money  to  repair . I think  the  use  of  active  controls  to  improve  an  airplane's 
fatigue  life  or  to  reduce  the  incidence  of  fatigue  damage  would  be  a good  objective 
for  the  era  we're  talking  about  . 

Kolk:  Yes,  but  I'd  like  to  point  out  that  the  budget  is  limited.  Take  an  airplane 
like  the  B-707 . It  sort  of  gets  tired  at  30,000  hours , so  you  reskin  it  for  a couple 
of  hundred  thousand  dollars  and  get  another  30,000  hours  out  of  it.  Other  airplanes 
I'm  familiar  with,  like  the  DC-6  airplane,  have  gone  through  this  cycle;  in  fact,  I 
think  there  are  DC -6  airplanes  flying  around  that  have  been  reskinned  twice  to 
keep  them  going  . And  it's  actually  a pretty  economical  way  to  extend  the  life  of  a 
structure.  So  unless  you  can  do  the  job  cheaply  enough  to  make  it  cheaper  than 
just  reskinning,  you  haven't  saved  anything. 

Carline:  It's  a question  of  economic  payoff  . It's  a trade , if  you  like— you've 
got  to  weigh  one  against  the  other . What  about  the  audience? 

J.  A.  Gorham:  A few  years  ago  I had  some  responsibilities  on  the  L-1011  air- 
plane to  do  with  controls  and  cockpits  and  avionics , and  I was  guilty  of  persuading 
all  the  airlines  to  try  all-weather  landing  systems . I'm  not  going  to  argue  about 
that  right  now . 

Much  has  been  said  about  the  possible  benefits  of  active  control  technology  in 
terms  of  saving  structural  weight  and  space  in  the  airplanes , center  of  gravity 
static  margins  and  so  on . I firmly  believe  that  active  control  technology  has  a role 
to  play,  and  I think  that  with  an  intelligent  program  by  NASA  and  industry  we'll 
find  out  what  it  is  and  we'll  make  the  tradeoffs.  I think  enough  has  been  said 
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about  the  need  to  make  tradeoffs  with  maintainability  and  reliability  and  the  need 
for  engineering  proofs.  The  idea  of  the  1985  era  worries  me  a little.  Do  you  mean 
beginning  to  design  a new  transport  in  1985  or  that  it  will  be  flying  then?  I think 
a better  definition  of  what  we  mean  by  the  1985  era  would  be  useful . 

Weil:  We  had  in  mind  putting  it  in  operation  shortly  after  1985,  not  starting  a 
cycle  that  might  go  to  1995. 

Gorham:  I don't  believe  that.  Looking  at  some  of  the  timetables,  I think  it 
might  be  possible  to  begin  a new  airplane  somewhere  between  1980  and  1985,  but 
not  to  have  it  in  operation  by  that  time  if  it’s  completely  control  configured  and 
employs  active  control  technology  to  a reasonable  degree. 

One  thing  that  hasn't  been  mentioned  is  the  role  active  control  technology  could 
play  in  cockpit  design . One  of  the  things  that  I would  like  to  have  done  with  the 
L-1011  airplane , since  a quadruplex  automatic  landing  system  has  been  installed 
that  can  be  depended  upon  in  landing,  is  to  cut  all  the  cables  and  take  out  the  con- 
trol column , which  obscures  the  lower  row  of  instruments.  So  if  we  are  going  to 
have  fly-by -wire  systems , let's  get  rid  of  the  control  column  and  improve  the  dis- 
play area  in  the  cockpit.  That's  obviously  one  advantage. 

Secondly  , we  have  programs  at  Langley  , which  I'm  concerned  with  to  some 
extent,  on  the  B-737  terminally  configured  vehicle  in  which  we're  developing  all 
sorts  of  advanced  electronic  displays , As  most  of  you  who  have  been  involved  with 
commercial  or  even  military  transports  know  , there  just  isn't  any  place  to  put 
electronic  maps  except  behind  the  throttles  , so  let's  get  rid  of  the  throttle  levers 
too.  If  we're  going  to  go  fly  by  wire  on  the  primary  controls,  we  can  do  it  on 
thrust  control  as  well . 

In  other  words , there  are  advantages  up  at  the  front  end  that  to  my  knowledge 
haven't  been  mentioned  during  this  symposium . That's  where  the  pilots  are  going 
to  see  the  benefits , and  that  might  just  help  us  persuade  them  that  this  thing  is 
worthwhile . 

As  far  as  major  obstacles  are  concerned , I think  most  of  them  have  been  dis- 
cussed already  . New  commercial  transports  are  begun,  not  because  we  plan  it  or 
want  it , but  because  of  competition . There  will  be  more  world  competition  now , 
not  just  competition  within  the  United  States , and  When  we  start  to  race , if  I'm  any- 
where involved,  I don't  want  to  try  on  a new  pair  of  track  shoes.  I want  to  know 
that  the  shoes  are  going  to  take  me  to  the  end  of  the  race  already . 

J.  J.  Tymczyszyn:  I think  we're  all  missing  one  point,  and  that's  the  applica- 
tion of  active  control  technology  to  vortex  wake  turbulence  alleviation . We  all 
realize  that  active  control  technology  is  a powerful  tool,  but  it  hasn't  been  fully 
explored  yet,  and  that  is  one  point  we  should  be  thinking  about  in  the  near  future. 

Weil:  That's  a good  point,  except  that  some  of  the  small  airplanes  that  intersect 
these  wakes  probably  won't  have  it . 
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W.  G.  Wells,  Jr.:  We've  been  listening,  of  course,  to  a discussion  of  5 or 
6 years  of  NASA's  experience  with  the  merits  and  demerits  of  active  controls.  I'm 
keenly  interested  in  Mr,  Treece's  and  Mr.  Kolk's  comments,  also  Mr.  Newberry's, 
about  the  great  need  for  reliability,  acceptance  by  the  pilots,  and  economic  viability. 
NASA  has  worked  with  the  F-8  digital  fly-by-wire  airplane,  but  my  question  is 
addressed  to  Mr  . Newberry's  recommendation  that  someone  ought  to  fly  an  airline 
type  of  airplane  for  an  extended  period  of  time  to  acquire  this  type  of  information . 
Now,  NASA  has  not  been  in  the  protytype  business,  and  it  seems  to  be  buffeted  in 
various  directions— told  to  get  out  of  or  into  the  prototype  business . I'd  like  to  get 
some  type  of  reaction  from  the  panel  as  to  whether  this  is  an  appropriate  thing  for 
NASA  to  be  involved  in  in  the  future . That  is , whether  it  should  undertake  a proto- 
type program . 

Newberry:  Well , in  my  view , the  role  that  NASA  ought  to  play  is  one  that's 
helpful.  In  the  early  days , NACA  developed  airfoils  when  other  people  didn't  have 
the  opportunity  or  capability  to . I think  that  through  the  years  NASA  has  become 
oriented  towards  basic  research . Certainly  I'm  in  favor  of  basic  research , but  I 
think  that  any  government  agency  ought  to  assist  and  not  to  resist.  If  indeed  it's 
the  greatest  help  to  put  this  airplane  into  service , to  drive  it  around  and  develop 
so  many  hours , and  as  Frank  mentioned  it  takes  a long  time  for  confidence  to  grow , 

I think  it  needs  to  be  done  in  a good  environment,  Ted  Bowling  gave  a paper  on 
B-52  stability  augmentation  system  reliability,  and  in  it  he  showed  a growth  curve. 
The  growth  curve  had  a slope  of  0.56.  Now,  the  average  growth  curve  for  those  is 
0.3.  The  reason  for  the  difference  is  that  a great  deal  of  attention  was  paid  to  that 
particular  program  . Something  was  done  about  every  little  thing  that  showed  up . 

We  recently  installed  a forward-looking  infrared  system  in  a low  light  television 
system  on  the  B-52  airplane  and  again  we  had  an  extensive  reliability  program. 

That  program  too  had  a growth  curve  of  approximately  0.56,  It  takes  a lot  of 
attention  to  get  reliability  . It  takes  the  minute  examination  of  resistors  , solder 
joints,  and  what  have  you.  There's  just  no  substitute  for  time,  and  we  need  to  get 
started  if  we're  going  to  have  it.  So  I think  that  a prototype  program  is  a good 
project  for  NASA.  It's  a project  the  rest  of  us  can't  afford.  I don't  think  the  air- 
lines can  afford  to  set  an  airplane  aside  and  fly  it  without  passengers  just  to  get 
time,  1 don't  think  a manufacturer  can  do  that.  I think  this  is  a role  that  govern-* 
ment  can  play  and  can  be  helpful  in  doing  so . x 

i 

Kolk:  I'd  like  to  add  to  that.  I think  that  not  only  is  the  role  a proper  one  for 
NASA— it's  also  a role  that  in  other  areas  NASA  has  already  begup  to  play  . I think 
that  NASA's  role  in  the  JT8  refan  program  is  similar , and  the  end  result  looks 
like  a finished  product . They  have  also  worked  in  other  programs  like  this , and 
I think  it's  a good  thing  for  the  total  community  for  NASA  to  do  it , Now , in  terms 
of  actually  choosing  an  airplane  to  fit  with  active  controls , you  have  to  look  around 
at  what’s  available . If  you  want  to  use  an  airplane  that  will  eventually  have  other 
uses,  you'll  have  some  other  problems  besides  the  control  system . You'll  have  to 
have  an  airplane  with  a lot  of  redundancy  built  into  its  design . The  earlier  genera- 
tion jet  transports  do  not  have  this  redundancy,  and  you'd  wind  up  with  a whole 
new  airplane  by  the  time  you  built  it  in.  However  , the  newer  airplanes,  particu- 
larly the  trijets  and  the  B-747  airplane,  do  have  redundancy  built  in  because  they 
all  envisioned  ali-weather  landing  systems . So  the  guts  of  the  airplane  can  take  it 
and  these  may  be  the  airplanes  to  use.  I don't  know  how  you're  going  to  make  the 
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transition  from  getting  that  kind  of  hardware  together  and  demonstrating  that  it'll 
fly  to  putting  it  into  passenger  service,  which  is  the  only  way  you're  going  to  get 
the  kind  of  time  on  it  to  prove  it . 

A.  B.  Barraclough:  I'd  like  to  address  the  question  of  the  obstacles  to  greater 
commitment  to  active  control  technology  and  turn  it  around  and  ask  what  can  be 
done  to  aid  its  application,  specifically  by  NASA.  One  thing  that  hasn't  received 
much  attention  is  the  requirement  for  reliability  data . The  requirement  is  to 
acquire  data  in  such  a way  that  the  data  can  be  used  at  the  drawing  board  level . 

One  of  the  significant  international  benefits  of  the  last  generation  of  aircraft  was 
that  there  was  a data  base  you  could  go  to  and  find  out  the  reliability  of  a given 
component  and  how  the  airlines  used  it . You  could  go  to  a maintenance  manual  and 
see  where  it  was  used  in  the  system  and  what  it  looked  like . You  could  rearrange 
it  to  use  in  your  own  system  and  come  up  with  some  reasonably  good  probability 
figures  which  told  you  its  safety  , its  unscheduled  removal  time,  its  mean  time 
between  scheduled  removals,  and  its  maintenance  man-hour  costs— in  effect,  every- 
thing from  its  cost  to  its  everyday  usage . With  some  useful  trade  factors , you  could 
then  compare  all  of  these  different  costs , put  them  on  a unit  basis  and  come  up  with 
some  kind  of  total  trace  of  cost . You  could  compare  an  electrical  system  with  a 
mechanical  system , a pneumatic  system , or  whatever , You  could  then  go  to  the 
chief  designer  and  say  that  this  system  was  better  than  this  one  on  a rational  basis . 
He  could  of  course  decide  one  way  or  the  other . But  it  is  a useful  tool . One  thing 
that  can  be  done  with  the  electrical  systems  is  to  set  up  a system  that  allows  infor- 
mation to  be  collected  that  can  be  used  at  the  drawing  board  level.  This  requires 
familiarity  with  the  information  system,  the  ability  to  become  familiar  with  it,  which 
means  some  kind  of  publication , and  finally  dispersal  throughout  the  industry . So 
the  question  for  industry  is  what  they  can  do  for  NASA  along  these  lines  . 

Weil:  I gather  that  you're  suggesting  that  NASA  or  some  government  organiza- 
tion underwrite  this  type  of  thing? 

Barraclough:  No , I wouldn't  say  NASA  specifically , but  I think  there  is  a 
major  obstacle,  which  is  that  we  don't  have  a data  bank  with  which  we  can  compare 
things . 

Lamar:  The  Air  Force  has  a system  much  like  the  one  you're  discussing  . The 
system  collects  data  in  quite  some  detail  on  component  removals,,  the  time  between 
removals , and  the  cause  of  the  problem . The  data  are  analyzed  right  down  to  the 
basic  level . Of  course , the  problem  is  that  that  kind  of  information  does  not  exist 
for  the  new  systems  we're  talking  about  because  there  is  no  flight  experience  with 
them . It  does  exist  for  a lot  of  command  augmentation  systems  that  do  have  elec- 
tronic components , however . 

Barraclough:  I understand.  I didn't  mean  to  bypass  the  Air  Force  system,  but 
the  point  is  that  there  is  no  system  that  addresses  itself  to  the  question  of  active 
controls  and  flying  controls  by  wire . 

Weil:  We've  heard  quite  a bit  about  ongoing  programs  and  programs  that  are 
planned  for  5,  6,  or  7 years  from  now.  The  space  shuttle  certainly  is  one.  How 
much  confidence  are  these  programs  going  to  produce  compared  with  what  exists 
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right  now?  Is  there  any  way  to  increase  their  relevance  or  to  change  their  direction 
in  such  a way  that  they  could  be  made  more  pertinent  to  the  airlines? 

Kolk:  The  problem  is  that  active  control  technology  is  sort  of  a technology 
looking  for  a mission . I would  like  to  have  a better  idea  of  exactly  what  active  con- 
trol technology  will  accomplish  when  it  is  applied  to  transports . That  will  provide 
a road  map  for  making  decisions , and  until  you  have  one  you  cannot  address  the 
issue  intelligently . 

Weil:  This  is  a little  far  afield  from  the  conventional  transport  area,  but  the 
Boeing  YC-14  airplane  has  a digital  flight  control  system  which  is  pseudo  fly  by 
wire.  It  will  fly  within  the  next  couple  of  years  . If  we  have  a reasonable  number 
of  hours  on  a vehicle  of  that  type,  would  that  provide  the  type  of  confidence  needed 
for  a long-haul  conventional  transport? 

Kolk:  Every  little  bit  helps'. 

Newberry:  Another  question  is  whether  ongoing  government  and  industry 
programs  adequately  address  the  obstacles  to  the  use  of  active  control  technology . 
Unless  I misunderstood,  Mr.  Skully  said  that  in  I960  the  FAA  held  a conference 
to  update  its  regulations . From  what  Bill  Lamar  and  I have  presented , most  of  the 
action  has  taken  place  since  1960.  Now  is  that  the  aggressive  action  the  FAA  is 
giving  us  in  regard  to  these  regulations  or  did  I misunderstand? 

Skully:  Frankly  , the  FAA  has  been  putting  out  regulations  on  a more  or  less 
ad  hoc  basis  over  the  last  decade . The  FAA  is  following  the  Concorde  activities . 

The  French  and  British  hope  to  have  it  ready  to  be  certificated  next  spring,  and  of 
course  that  is  a fly -by -wire  piece  of  equipment.  I had  the  privilege  of  riding  in  it 
from  Boston  to  Miami  and  returning , and  there  were  a few  things  going  on  that 
surprised  me . The  approach  mode  was  made  with  the  autothrottle . A question  was 
raised  earlier  as  to  why  you  have  the  throttle , and  it's  a good  point . The  throttle 
is  there  just  because  it's  traditional.  The  captain  was  flying  the  Concorde  manually  , 
and  he  programed  his  airspeed  with  the  autothrottle  . The  autothrottle  was  just 
providing  the  thrust  necessary  to  maintain  his  reference  speed  . 

We're  looking  at  our  landing  distance  requirement  again  from  a certification 
standpoint.  The  Concorde  doesn't  have  flaps,  and  it  doesn't  have  spoilers.  We 
are  working  with  NASA  quite  actively  to  try  to  determine  a better  way  to  assess 
runway  slipperiness . All  these  efforts  will  help  to  establish  or  modify  the  regula- 
tions . 

C.  L.  Seacord:  There  are  two  rather  new  programs  that  are  intended  to 
address  the  obstacles . One  is  to  determine  the  measure  of  acceptability  of  the 
advanced  systems . 

We've  had  some  experience  recently  with  trying  to  find  out  what's  required 
for  the  autoland  sensors  in  terms  of  reliability  for  the  all-weather  landing  system. 
Maybe  integrity  is  the  right  word  these  days . It's  extremely  difficult  to  find  a 
realistic , usable  failure  rate  probability  number . There's  talk  about  changing  the 
probability  from  10“'^  to  10“®  . When  you  look  at  the  reason  for  doing  so  there  really 
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isn’t  one.  Neither  is  there  a good  way  to  measure  what  we  have.  I think  one  worth- 
while activity  for  the  FAA  is  the  reevaluation  and  restatement  of  the  integrity 
requirements  and  the  way  in  which  the  requirements  are  measured . 

In  addition,  there  is  a series  of  operations  that  could  be  performed  to  generate 
the  data  that  the  airlines  would  like  to  have  and  undoubtedly  need . They  don't 
need  to  have  a prototype  airplane  or  two  prototype  airplanes  flown  a few  hundred 
hours  a year . They  need , as  several  people  have  already  mentioned , data  for  on 
the  order  of  50 , 000  hours  of  flight  in  a realistic  transport  environment . The  only 
way  these  data  can  be  obtained  is  by  installing  some  of  this  equipment , representa- 
tive fly-by-wire  equipment,  whether  it's  being  used  for  that  or  not,  on  airplanes 
in  scheduled  service.  Perhaps  they  operate  in  a parallel,  duplicate  way,  so  you 
can  throw  a switch  and  take  it  out  of  the  system  and  the  airplane  can  go  on  about 
its  business . This  is  a program  that  neither  the  aircraft  industry  nor  an  airline 
is  likely  to  pay  for;  therefore,  I think  it  is  up  to  a government  agency  or  a combina- 
tion of  DOT,  NASA,  and  the  military  . I think  that  even  prior  to  that,  though,  you 
need  to  try  to  figure  out  how  you're  going  to  run  the  big  program . Because  I 
think  that  even  if  someone  popped  up  with  $10  million  right  now  and  said  "Go  do  it  , " 
there  would  be  about  4 years  of  confusion  about  what  you  were  going  to  do  and  what 
you  would  record  and  how  you  would  analyze  what  you  did  record . 

So  I think  you  need  a program  to  define  the  requirements , to  determine  what  is 
good  enough,  what's  reliable  enough,  and  how  to  measure  it.  Then  there  should  be 
an  introductory  program,  probably  involving  flight  tests  of  a representative  jet  air- 
plane, to  develop  techniques  for  the  large  program  . The  large  program  would  then 
consist  of  the  government  procurement  of  the  systems  and  their  installation  and 
record  keeping  for  them . The  systems  should  be  used  in  regularly  scheduled  ser- 
vice to  produce  at  least  50,000  hours  of  data. 

G.  O.  Thompson:  It  seems  to  me  that  programs  with  clearly  defined  goals  are 
the  ones  that  make  major  contributions  . I think  one  reason  so  much  was  accom- 
plished in  the  Saturn-Apollo  program  was  that  the  goal  was  so  clearly  defined . You 
may  recall  that  in  a movie  von  Braun  produced  , he  stated  that  that  was  one  of  the 
most  important  reasons  that  that  program  succeeded . It  had  a clear  goal:  go  to  the 
moon,  return,  and  land  safely,  by  1970.  That  goal  was  accomplished.  That  goal 
was  kept  in  front  of  everyone . It  seems  to  me  that  one  of  the  biggest  problems  in 
active  control  technology  is  that  neither  we  nor  NASA  has  a clearly  defined  goal . 

I'm  somewhat  familiar  with  NASA's  plans.  I think  that  one  of  the  biggest  contribu- 
tions we  could  make  would  be  to  motivate  NASA's  management  to  establish  a clearly 
defined  goal  within  the  framework  the  panel  has  discussed  and  set  a time  period  for 
that  goal. 

Weil:  As  I understand  you,  you're  saying  that  NASA  should  bite  the  bullet  and 
instead  of  going  to  the  moon  establish  a goal  of  perhaps  20  percent  to  25  percent 
improvement  in  performance  or  fuel  savings  and  then  go  after  it? 

Thompson:  I'm  saying  that  NASA  needs  clearly  defined  goals  for  commercial 
transports  comparable  to  those  that  were  established  for  space . 
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Weil:  How  do  you  justify  that  to  the  Office  of  Manpower  and  Budget?  I think 
the  answer  to  that  is  that  we  have  to  run  cost-benefit  studies , and  if  we  come  up 
with  a ratio  of  benefit  to  cost  of  20  or  25  to  1 , and  believe  it,  I think  the  risk  is  good. 

J.  T.  Rogers:  As  a conservative  structures  guy , I would  like  to  see  an  effort 
made  to  separate  the  benefits  of  using  control  configurations  from  the  benefits  to  an 
actual  airplane . For  example , the  load  alleviation  studies  generally  have  talked 
about  moments,  but  you'll  find  when  you  design  a wing  that  torsion  plays  a fairly 
important  part  and  that  all  the  controls  we  have  talked  about  are  large  torsion 
producers . So  one  of  the  things  I think  would  contribute  a lot  would  be  to  separate 
the  items  that  contribute  a large  payoff  from  items  that  fall  in  the  gray  area  of  "is 
it  or  is  it  not  a gain . " 

Newberry:  In  this  field,  as  in  many  fields , we  have  a great  deal  of  synergism . 
When  we  start  to  introduce  one  or  two  things  we  get  additional  benefits  . One  of  the 
things  we  saw  in  the  C-5  presentation  was  that  it  had  a restriction  similar  to  one 
we  had  on  the  B-52  airplane , and  that  is  the  use  of  control  surfaces  that  were 
already  there . Those  control  surfaces  were  deliberately  designed  not  to  stir  up 
structure  modes.  Now  we're  constrained  to  pse  them  to  damp  structure  modes.  I 
think  if  the  designer  has  some  freedom  to  apply  the  concepts  we're  talking  about 
we'll  see  many  more  benefits.  The  fact  that  there  is -torsion  is  obvious  if  you're 
going  to  use  only  a trailing-edge  device . Why  not  use  the  trailing  edge  and  the 
leading  edge  together  and  eliminate  that  sort  of  thing?  You're  right  , we  need  to 
sit  aside  and  look  at  these  benefits  as  they  are , but  I think  that  we  ought  not  be  too 
quick  to  say  that  we'll  throw  out  anything  under  10  percent  . That  one  thing  may 
be  the  catalyst  that  brings  other  benefits  into  being , so  it  becomes  beneficial  for 
the  total  active  control  airplane . 

P,  G.  Felleman:  As  far  as  NASA  funding  a large  program  to  demonstrate  safety 
or  reliability  or  whatever  by  implementing  active  controls  in  a large  fleet  of  aircraft 
is  concerned,  I don't  think  that  is  a goal  NASA  should  be  involved  in.  I think  NASA 
should  be  bringing  technology  to  a state  where  it  is  feasible  and  available . When 
the  cost  benefits  come  along,  for  example,  when  there  is  another  30-percent,  40- 
percent,  or  100-percent  increase  in  fuel  costs,  the  airlines  will  be  quick  to  look  for 
things  that  will  reduce  those  costs , and  that  will  make  active  controls  the  economi- 
cally viable  thing  to  do . It  happened  in  the  inertial  navigation  business . Inertial 
navigation  was  not  developed  for  the  commercial  aircraft  industry.  It  was  devel- 
oped for  other  purposes.  When  the  airlines  saw  the  economic  feasibility  of  using 
inertial  navigation , it  became  available  to  them . 

Newberry:  I don't  think  it's  very  progressive  to  say  that  because  NASA  has 
had  a certain  role  over  the  years , it  ought  to  keep  that  role  and  not  step  into 
another  area. 

J.  K.  Wimpress:  I think  I agree  with  Dick  Holloway's  comments  yesterday, 
that  control-configured  vehicles  and  active  control  technology  are  really  just  a part 
of  the  aeronautical  engineer's  bag  of  tricks.  They  aren't  going  to  revolutionize 
the  whole  appearance  of  the  airplane  . They're  just  other  things  that  will  have  to 
be  integrated  into  the  airplane . And  I think  it's  difficult  to  set  goals  for  that  kind 
of  thing . 
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I think  back  20  years  when  the  airlines  were  dragged  into  the  jet  age . At  that 
time  they  didn’t  want  anything  new  either . They  predicted  dire  things  for  the  jet 
engine;  they  used  too  much  fuel,  you  couldn't  even  stand  to  taxi  out  with  them; 
nobody  knew  what  their  reliability  was;  they  had  terrible  balance  problems;  how 
were  they  ever  going  to  maintain  them.  Of  course,  once  jet  engines  were  in  service, 
the  airlines  found  that  they  set  an  entirely  new  standard  and  that  the  problems 
weren't  nearly  as  great  as  anticipated . The  engines  used  by  the  first  jet  transports 
were  military . They  were  developed  for  the  military  and  went  through  the  kind  of 
process  Bill  Lamar  discussed  for  evaluation  . If  you  look  at  the  number  of  hours  on 
the  jet  engine  at  the  time  it  went  into  commercial  service,  it  was  actually  quite  low 
compared  with  the  number  the  airlines  began  putting  on  it , and  yet  the  engine 
served  well.  In  the  case  of  the  engines , then,  the  commercial  incentive  got  to  be 
such  that  the  engine  was  constantly  improved,  and  engines  like  the  turbofanjet 
were  developed  not  for  the  military  but  for  the  commercial  people . The  point  is 
that  the  airlines  were  willing  to  accept  an  engine  entirely  new  to  them  on  the  basis 
of  military  experience  that  was  relatively  low , yet  large  enough  to  be  statistically 
valid.  I can  see  the  same  path  for  the  fly -by-wire  control  system . The  military 
will  have  to  take  the  lead;  they'll  put  it  on  some  of  the  airplanes  they're  going  to 
use  over  an  appreciable  length  of  time , and  that  will  develop  enough  time  to  be 
statistically  valid  and  it  can  then  be  put  into  commercial  service . In  our  thinking 
we  should  also  distinguish  between  the  electronic  control  and  so-called  control- 
configured  vehicles . Confidence  has  to  be  developed  in  electronics  and  electric 
systems  and  not  in  the  ability  of  the  control  surface  to  move  and  create  an  aerody- 
namic load  that  will  favor  the  airplane  . The  former  can  certainly  be  developed  in 
the  way  that  I've  described . I think  the  latter  has  just  developed  as  part  of  the 
preliminary  design  process . 

R.  E.  Coykendall:  I think  that  we  in  the  airlines  are  somewhat  impressed  with 
what  the  military  has  done  with  some  of  these  systems  and  the  expertise  that  has 
been  developed.  On  the  other  hand,  we  also  feel  that  the  military  is  somewhat 
enamored  of  the  airlines'  philosophies  and  practices.  That  is  to  say  , they  are  now 
coming  to  the  airlines , asking  us  to  show  them  how  to  maintain  vehicles  on  a long- 
term basis . This  presents  an  opportunity  for  a program  wherein  the  military  and 
the  airlines  pool  their  information  on  the  maintainability  of  aircraft  and  aircraft 
systems  in  particular . That  could  be  turned  to  real  advantage  in  that  it  would  show 
what  the  airline  maintainability  requirement  for  active  control  technology  really  is . 
Do  you  agree,  Frank? 

Kolk:  That's  basically  right.  You  know,  we've  got  a whole  host  of  gadgets  on 
airplanes  that  are  there  for  a good  reason,  and  if  they  go  awry,  funny  things 
happen  . I think  one  of  the  most  startling  pieces  of  machinery  I ever  had  anything 
to  do  with  was  the  stick  pusher . We  operated  a fleet  of  30  airplanes  for  a number 
of  years  with  stick  pushers  and  I never  knew  the  stick  pusher  to  bomb  out  on  us  . 

It  always  worked  when  it  was  supposed  to  work  and  it  didn't  go  off  when  it  wasn't 
supposed  to  go  off.  You  can  come  up  with  all  kinds  of  examples  of  things  that  will 
have  to  work  full  time , with  no  bail-out  route , to  take  full  advantage  of  active  con- 
trol technology . 

So  the  military  people  get  into  active  control  technology  and  General  Dynamics 
wants  to  expand  the  maneuver  envelope  for  their  lightweight  fighter , so  they  make 
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the  tail  work  for  them  instead  of  against  them . It  was  a big  payoff  in  an  intensely 
competitive  situation.  It’s  a pretty  interesting  system,  but  the  point  is  that  at  least 
on  the  face  of  it  they  seem  to  have  made  it  work  and  for  the  first  time . This  kind  of 
background  is  going  to  help . Now  I think  the  airlines  should  be  a little  less  chary 
of  sharing  some  of  the  information  that  they  have . They  have  so  much  information 
in  bits  and  pieces  collected  over  the  years  that  it's  a monster  of  a chore  just  to  get 
it  all  in  one  place . Some  of  that  material  might  relate  to  these  problems , Some  of 
our  experience  with  electronics  may  also  pertain  to  some  of  these  things , and  I 
would  like  to  see  something  set  up  on  a cooperative  basis . Certainly  we  can  try . 
And  certainly  some  of  the  things  we  found  out  about  engines  are  of  interest  to  the 
military  people,  because  I understand  that  they  have  to  make  them  work  the  first 
time  now  or  they  don't  sell  them . We  have  the  same  problem . All  of  us  are  faced 
with  this  problem.  We've  got  to  minimize  risk,  and  how  do  we  devise  a system  that 
minimizes  risk?  Maybe  NASA  can  serve  as  a catalyst  for  this . 

I think  this  meeting  is  significant,  because  this  is  the  first  time  in  20  years  that 
I've  seen  this  many  people  in  a room  talking  about  airplanes.  I've  been  going  to 
meetings  for  a long  time  and  I want  to  congratulate  everyone  for  coming  and  I want 
to  congratulate  NASA  for  inventing  some  way  to  get  everyone  together , which  I was 
afraid  was  a lost  art  these  days . Just  talking  like  this  is  going  to  help . There's 
something  there  and  we  need  to  use  it.  It's  not  a cult.  It's  a tool,  and  now  it's  a 
question  of  rolling  up  our  sleeves  and  getting  on  with  the  job.  Anything  construc- 
tive has  got  to  be  taken  in  a constructive  way  and  I think  we're  all  willing  to  do 
that. 


R.  E.  Kestek:  The  problem  we  seem  to  be  working  on  is  benefits  for  commer- 
cial transport  . We  pointed  out  that  the  safety  required  to  fly  your  grandmother  is 
of  prime  importance  yet  difficult  to  achieve . How  do  you  do  it?  You  need  her  on 
board  to  pay  for  the  flight  unless  you  have  a large  amount  of  money  from  some  other 
source.  In  past  programs,  the  airlines  relied  on  the  efforts  of  the  military,  which 
I think  has  some  possibilities.  Some  people  have  talked  about  that.  Sitting  here, 
an  idea  occurred  to  me . There  is  a commercial  airliner  in  military  service  that  is 
being  serviced  by  the  commercial  airlines  • That  is  the  T-43  airplane , and  I believe 
it's  being  serviced  by  United  Airlines.  One  of  our  problems  is  to  get  the  airlines 
and  the  military  to  talk  to  each  other  , and  here  is  a vehicle  that  is  identical  to  an 
airline  vehicle , being  flown  at  high  speeds  and  low  altitudes , where  fatigue  is  a 
problem  and  ride  is  a problem.  Here  is  a vehicle  with  a need  for  active  control 
technology,  and  it  is  being  serviced  by  the  airlines,  who  we  are  trying  to  get  the 
information  to . It  is  being  flown  by  the  military , so  we  can  install  a system  in  it 
for  a reasonable  price . It  seems  as  though  that  would  be  a good  approach  to  take 
to  investigate  the  various  aspects  of  this  problem . 

Coykendall:  To  comment  on  this  question,  yes,  we  are  under  contract  to  the 
Air  Force  to  maintain  a fleet  of  T-43  airplanes , Not  all  of  the  actual  manpower  is 
ours , but  the  maintenance  program  is  and  four  of  our  people  are  stationed  at  the 
Air  Force  base  in  Sacramento  to  supervise  the  program . I'm  not  aware  of  any 
restrictions  on  exchanging  information  in  that  program . 

In  this  case,  the  Air  Force  came  to  an  airline  and  said  that  it  thought  the  way 
the  airlines  maintained  airplanes  over  the  long  term  had  some  advantages  compared 
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with  the  way  the  Air  Force  did  it  and  asked  the  airlines  to  do  it  for  a while  . This 
presented  an  opportunity  for  the  Air  Force  to  experience  monitoring  the  results 
and  collecting  the  information  necessary  for  long-term  maintenance.  I don't  think 
it’s  even  necessary  to  have  active  control  technology  systems  as  such  installed  in 
those  airplanes . What  1 am  referring  to  is  giving  the  military  the  opportunity  to 
observe  airline  objectives  and  goals  in  maintenance  and  maintainability. 

C.  D.  Bar  dick:  If  we  take  the  stick  out  of  the  cockpit,  and  1 guess  we  would 
take  the  rudders  out  too , and  we  take  the  throttles  out  of  the  cockpit  and  put  a 
couple  of  little  switches  in  there , I wonder  how  the  pilot  is  going  to  feel  about 
looking  at  the  instruments  and  all  the  information  that  is  presented  to  him  for  the 
purpose  of  flying  the  airplane  by  hand  through  the  stick,  rudder,  and  throttle. 
Maybe  NASA  should  look  at  the  interface  between  the  automatic  control  systems , 
which  are  creeping  into  commercial  vehicles  in  increasing  numbers , and  the  human 
operator , whose  role  is  changing  from  being  the  operator  to  being  more  of  an  assist- 
ant manager . Are  we , in  fact , providing  the  airline  captain  with  the  kind  of  infor- 
mation he  needs  to  manage  these  automatic  control  systems  in  essentially  a nonoper- 
ator's role?  Maybe  NASA  should  undertake  it,  because  if  an  airline  does  it,  it's 
kind  of  touchy  for  airline  management  and  the  Airline  Owners  and  Pilots  Associa- 
tion (AO PA)  . It’s  kind  of  a touchy  subject  for  the  Boeing,  Lockheed,  or  Douglas 
people  to  get  involved  with  , and  it’s  kind  of  a.  touchy  subject  for  the  FAA  to  get 
involved  with , so  it  seems  as  if  NASA  may  be  the  only  organization  that  can  touch 
it  without  having  its  fingers  burned.  Since  we  have  an  airline  captain  on  the  panel, 
maybe  he  would  like  to  address  the  subject  of  the  flight  crew’s  role  in  increasingly 
automatic  airplanes . 

Treece:  I’d  like  very  much  to  talk  about  it.  First,  we  accepted  the  wheel  in 
transports  years  ago  as  opposed  to  the  stick,  and  now  we're  back  to  the  stick.  So 
I think  we’re  amenable  to  something  new.  I think  that  there  is  a general  movement 
in  the  industry  to  enlarge  the  role  of  airline  captain  to  that  of  manager.  You  should 
realize  that  he’s  managing  a pretty  expensive  segment  of  the  airlines  and  that  he  is 
a manager.  We’re  encouraging  airline  captains  to  manage  better,  and  they  have 
done  a much  better  job . If  you  look  at  our  fuel  costs  and  the  efficiency  with  which 
we  have  operated  over  the  last  2 or  3 years , I think  it  is  self  evident  that  they  are 
challenged  by  this  and  that  they  are  doing  a better  job  of  managing.  We  talked  at 
great  length  with  some  of  the  people  in  the  FAA  with  respect  to  removing  the  con- 
trol column,  the  throttles,  and  the  rudders,  and  it  opens  up  a lot  of  space  we  badly 
need  for  indicators  and  navigational  equipment  and  that  sort  of  thing . I think 
there’s  going  to  be  some  sort  of  resistance  among  the  pilots  to  removing  these 
traditional  things , but  it  certainly  won’t  take  long  to  convince  them  if  it  is  in  fact  a 
better  way . I don’t  have  any  objection  to  it  • I think  it  could  be  sold  very  easily 
once  it  has  been  shown  that  it’s  a better  way. 

Somebody  made  a remark  a while  ago  about  buying  new  equipment.  Not  too 
many  airlines  are  beating  a path  to  airplane  manufacturers’  doors  these  days 
looking  for  new  equipment  over  and  beyond  what  they’re  already  committed  for . 
There’s  some  thought  that  some  of  us  have  too  much,  so  we’re  not  looking  for  any 
new  problems  at  the  moment . But  the  airlines  will  adopt , and  not  reluctantly , 
something  that  is  more  efficient , safer  to  operate , or  has  some  other  type  of  advan- 
tage. This  is  no  different  than  in  the  past.  I don’t  think  the  airlines  are  going  to 
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get  together  and  sell  the  manufacturers  on  active  control  technology  or  control- 
configured  vehicle  equipment  . The  manufacturers  are  going  to  have  to  grab  this 
ball  and  convince  the  users  that  this  is  a better  way  to  go . ^ 

Gorham:  I had  some  comments  a while  ago  , but  in  view  of  what's  been  said 
I've  modified  them  a little.  I was  going  to  say  that  a new  program  is  essential  to 
establish  the  benefits  of  active  control  technology , and  I think  we've  talked  that  to 
death,  probably  because  it's  pretty  obvious  that  the  tradeoffs  have  to  be  pretty 
well  established  to  know  what  investigations  you  have  to  make , We're  investigating 
active  control  technology . Fine , but  is  there  anything  in  the  structural  area , the 
cockpit  area  or  any  other  part  of  the  airplane  which  the  tradeoffs  show  might 
bring  benefits  if  changed  or  modified?  Let's  not  get  to  a point  in  5 years'  time 
where  the  technology  of  fly  by  wire  has  been  thoroughly  investigated  and  is  a tool 
that  could  be  used  and  when  we  do  the  tradeoffs  we  find  some  other  technology 
gives  a greater  payoff.  A broad  cut  of  tradeoffs  must  be  established  to  decide  what 
other  areas  of  technology  might  relate  to  the  incorporation  of  active  control  technol- 
ogy. 

Another  point  I'd  like  to  make  is  that  something  happens  because  there's  a need 
for  it.  This  is  getting  back  to  Frank  Kolk's  point,  which  I don't  take  too  much 
umbrage  at,  but  which  I will  remember  for  a while,  about  all-weather  automatic 
landing  systems . I well  remember  the  airlines'  introducing  a system  called 
aircraft  integrated  data  system  (AIDS)  7 or  8 years  ago , For  those  of  you  who 
don't  know  what  AIDS  is , it  is  a very  complex  recording  system  which  a certain 
major  airline  hoped  to  install  in  an  airplane . It  involved  more  electronic  boxes 
than  were  on  the  airplane  at  the  time , and  it  was  hoped  that  it  would  improve  the 
reliability  of  the  lesser  avionics  that  were  already  being  carried . It  was  kind  of 
irrelevant.  I remember  standing  up  just  like  this  in  New  York,  and  the  speech  I 
made  was  that  I had  sat  there  for  4 days  and  heard  a detailed  description  of  a solu- 
tion, but  that  I didn't  really  know  what  the  problem  was.  So  there  are  systems  that 
go  into  airplanes  where  everybody  has  been  mistaken. 

Multiplex  entertainer,  a complex  and  difficult  system,  was  introduced,  and  it 
fell  into  a lot  of  problems  on  the  Boeing  B-747,  the  Douglas  DC- 10,  and  the 
Lockheed  L-1011  airplanes.  However,  when  the  airlines  asked  if  they  could  take  it 
I off,  and  we  asked  if  they  would  accept  a 1000-pound  weight  penalty  for  taking  it 
off,  which  is  the  weight  of  the  wiring,  of  course  they  said  no.  My  point  is  that 
there  was  really  a big  advantage . Some  way  had  to  be  found  to  make  it  work , and 
we  did. 

Finally , Mr . Seacord  made  a point  about  all-weather  automatic  landing  systems 
and  the  need  to  look  at  the  reliability  of  the  sensors . I take  exception  to  that , and 
I think  the  airlines  and  Mr . Skully  should  too , because  we  now  have  at  least  three 
airplanes  certificated  for  all-weather  automatic  landing  systems  , and  I'm  sure  the 
FAA  and  its  British  counterpart  wouldn't  have  given  that  permission  if  they  hadn't 
been  satisfied  with  the  sensors'  reliability.  His  point  on  10“’  and  10“®  is  semantic, 
really . Without  going  into  any  details , one  involves  an  individual  risk  and  the 
other  involves  a collective  risk.  It's  just  a different  way  to  do  the  bookkeeping. 
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Finally , I regard  the  aircraft  industry  as  being  all  of  us , not  as  separate  from 
NASA , DOT , and  the  airlines . Even  consultants , I think , should  be  included  in  the 
airline  industry . 

Skully  : One  of  the  comments  I certainly  supported  was  about  establishing 
clear  goals.  I think  that  to  attain  these  goals,  and  there's  more  than  one,  we'll 
have  to  make  a well  coordinated  effort , It  might  be  helpful  to  look  at  some  other 
programs . One  that  two  of  my  colleagues  and  I are  very  much  involved  in,  or  have 
been,  is  the  two-segment  approach  program.  I am  happy  to  see  Mr.  Wells  from  the 
House  staff  here , because  the  FAA  has  been  beaten  on  the  head  pretty  severely . 

NASA  was  funded  by  Congress  to  develop  the  two-segment  approach.  Frankly  , I 
don't  know  what  went  wrong.  I don't  know  why  we're  in  the  state  that  we're  in  at 
the  moment.  American  Airlines  picked  up  the  project  and  did  a great  deal  of  work 
on  the  B-707  airplane— Frank  Kolk  was  the  master  mind,  followed  by  United  Airlines. 
Lloyd  Treece  and  I have  flown  United's  effort  in  the  B-727  and  DG-8  airplanes.  We 
just  finished  the  advance  notice  for  rule  making . It  went  over  like  a lead  brick . 

The  comments  were  due  at  the  end  of  June,  and  I'm  almost  afraid  to  read  them.  The 
position  of  the  Aerospace  Industries  Association  (AIA)  is  that  they  are  very  much 
against  it.  The  Airline  Pilot's  Association  (ALPA) , the  AOPA,  the  National  Business 
Aircraft  Association  (NBAA)— any  organization  you  want  to  name  thinks  it's  just 
terrible.  The  point  I'm  trying  to  get  at  here  is  that  we've  spent  a lot  of  time,  effort, 
and  money  , and  I don't  know  if  it's  going  to  fly  or  not  . Obviously  , the  objective  is 
to  reduce  noise . I might  add  that  I'm  a little  surprised  that  I haven't  heard  any  com- 
ments during  this  symposium  about  what  active  control  technology  might  do  in  terms 
of  opening  or  keeping  open  some  of  the  critically  closed'- in  airports . If  it  does , it 
has  a payoff. 

Lamar:  I believe  ongoing  programs  in  the  Air  Force  address  the  major  obsta- 
cles to  utilizing  this  type  of  technology . Of  course , Air  Force  cargo  aircraft  do 
have  command  augmentation  systems  in  them . We  are  getting  a lot  of  experience 
with  them,  and  that  experience  is  directly  relatable  to  fly  by  wire.  I think  the  next 
step  would  clearly  be  the  fly -by -wire  transport.  Once  we  depend  on  fly  by  wire, 
we  can  without  too  much  hesitation  incorporate  the  control-configured  vehicle  con- 
cepts that  have  been  shown  to  provide  real  payoffs  in  the  design  studies . What 
we're  trying  to  do,  of  course,  is  to  make  options  available  to  the  designers.  There 
are  gaps  in  the  program,  and  we're  trying  to  fill  them,  For  example,  there  is  a 
lot  of  work  under  way  right  now  and  being  planned  to  insure  the  satisfactory  integra- 
tion of  digital  avionics , so  that  the  capabilities  of  digital  processes  are  exploited 
in  the  military  subsystems  of  the  aircraft . We  are  also  trying  to  exploit  them  for 
digital  flight  control.  We  are  moving  towards  more  digital  flight  control  and  the 
use  of  multimode  capabilities . We  are  working  on  the  displays , the  controllers , and 
the  other  components  that  go  with  it . We  are  looking  at  what  it  takes  to  get  the 
human  operator  integrated  into  it  in  the  most  economical  fashion . 

The  Air  Force  is  concerned  about  overhead  and  maintenance  costs , operational 
costs . For  that  reason  we  are  interested  in  pursuing  any  lessons  learned  by  the 
airlines . If  there  is  any  way  we  can  work  together,  I am  sure  that  we  will  be  willing 
to  do  so.  I think  we  ought  to  develop  joint  programs  between  NASA,  the  Navy,  and 
the  Air  Force  to  make  our  dollar  go  as  far  as  possible  to  achieve  this  new  technology  . 
The  basic  program  plans  are  under  way,  but  they  are  underfunded. 
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Newberry:  I would  like  to  comment  on  what  actions  and  coordination  are 
needed.  I think  that  this  meeting  itself  is  necessary  and  a first  step  in  bringing 
industry , the  airlines , and  the  aviation  community  together . I think  that  NASA  and 
the  Air  Force  should  be  complimented  for  putting  together  this  symposium . I think 
I speak  for  many  others  in  saying  that  it  has  been  an  enjoyable  symposium  , enjoy- 
able in  that  it  has  provided  an  opportunity  to  meet  old  friends . All  of  us  tend  to 
become  too  busy  working  in  our  own  areas  to  communicate  with  others  involved  in 
the  technology . This  symposium  has  provided  an  opportunity  for  the  interested 
and  affected  parties  to  discuss  this  important  technology . 

Weill  Our  time  has  run  out  for  the  panel  discussion.  I think  it  was  quite 
productive.  We  at  NASA  appreciate  the  constructive  comments  on  our  programs  from 
the  airlines  and  industry , and  I'm  sure  your  comments  will  affect  pur  thinking  on 
future  programs . I would  like  to  thank  the  panel  members  and  the  audience  for 
their  participation  . 
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SOME  EXPERIENCES  USING  WIND-TUNNEL  MODELS 
IN  ACTIVE  CONTROL  STUDIES 


Robert  V.  Doggett,  Jr. , Irving  Abel,  and  Charles  L.  Ruhlin 
NASA  Langley  Research  Center 


SUMMARY 


A status  report  and  review  of  wind-tunnel  model  experimental  techniques 
that  have  been  developed  to  study  and  validate  the  use  of  active  control 
technology  for  the  minimization  of  aeroelastic  response  are  presented.  Model- 
ing techniques,  test  procedures,  and  data  analysis  methods  used  in  three  model 
studies  are  described.  The» studies  include  flutter  mode  suppression  on  a 
delta-wing  model,  flutter  mode  suppression  and  ride  quality  control  on  a 
l/3G-size  model  of  the  B-52  CCV  airplane,  and  an  active  lift  distribution 
control  system  on  a 1/ 22-size  C-5A  model. 


INTRODUCTION 


Dynamic  and  aeroelastic  wind-tunnel  models  have  played  an  important  role 
in  the  development  of  aircraft  and  space  technology.  In  many  instances  model 
tests  are  the  most  economical  means,  both  in  terms  of  time  and  cost,  of 
determining  heeded  data  as  compared  to  other  methods  such  as  analysis  and 
flight  tests.  Models  can  be  used  to  obtain  results  at  conditions  where  ana- 
lytical results  are  known  to  be  inaccurate,  for  instance,  transonic  speeds. 
Ordinarily  model  results  can  be  obtained  in  a more  timely  manner  than  flight 
results,  and  model  tests  are  more  amenable  to  conducting  extensive  parametric 
studies  than  are  flight  tests.  Aviation  applications  of  dynamic  models  have 
included  such  diverse  areas  as  flutter,  gust  response,  and  landing  loads  while 
space  application  includes,  among  others,  launch  vehicle  buffeting  and  ground 
wind  load  studies.  Some  of  the  many  uses  of  models  in  aerospace  applications 
are  described  in  references  1 and  2,  for  example.  Perhaps  the  extensive  use 
of  models  is  best  illustrated  by  the  fact  that  a literature  search  under  the 
category  of  dynamic  models  gives  a listing  of  over  2500  publications.  This 
continued  use  of  models  has  resulted  in  modeling  technology  reaching  a rather 
advanced  state  of  development.  However,  new  technology  and  advanced  concepts 
are  continually  being  developed  which  offer  new  challenges  to  modeling  tech- 
nology. Active  control  technology  is  one  of  the  latest  challenges. 

The  addition  of  active  controls  to  models  adds  a new  complexity  to  model- 
ing technology.  In  particular,  control  surface  and  actuation  systems  must  be 
miniaturized,  usually  under  severe  weight  restrictions,  and  new  testing  tech- 
niques must  be  developed. 
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The  NASA  Langley  Research  Center  has  embarked  on  a research  program  to 
develop  experimental  techniques  so  that  wind-tunnel  models  can  be  employed  to 
study  and  validate  active  control  systems  used  to  minimize  aircraft  aeroelastic 
response.  Although  the  major  thrust  of  this  work  is  experimental,  considerable 
emphasis  is  also  being  placed  on  the  development  of  analytical  techniques. 

This  paper  presents  a status  report  and  review  of  the  experimental  work  that 
has  been  accomplished  to  date.  An  earlier  status  report  is  presented  in 
reference  3.  Some  experiences  in  the  testing  of  three  different  models  in  the 
Langley  transonic  d3mamics  tunnel  are  reported  herein.  In  addition  to  pre- 
senting some  basic  experimental  results  from  the  three  studies,  such  topics  as 
model  design  and  construction,  active  control  system  implementation,  and  wind- 
tunnel  test  techniques  are  discussed.  Some  comparisons  between  model  experi- 
mental results  and  analysis  are  made,  and  in  one  instance  some  comparisons 
between  model  and  flight  test  results  are  presented. 

The  first  model  program  is  a flutter  suppression  study  using  a delta-wing 
model.  This  research  model,  which  is  a simplified  representation  of  a contem- 
porary supersonic  transport  design,  was  used  to  develop  basic  flutter  suppres- 
sion modeling  technology  and  to  evaluate  the  aerodynamic  energy  flutter 
suppression  concept  developed  by  Nissim  in  reference  4.  In  addition  to  the 
results  presented  in  ref  erence  3,  some  later  *data  obtained  by  using  the  delta- 
wing  model  are  presented  in  reference  5.  The  second  model  study  used  a 1/30- 
size  dynamically  scaled  aeroelastic  model  of  the  B-52  control  configured 
vehicle  (CCV) . Both  flutter  mode  control  (FMC)  and  ride  quality  control  (RQC) 
systems  were  implemented  in  this  model  study  which  was  done  in  cooperation  with 
the  Air  Force  Flight  Dynamics  Laboratory.  Some  B-52  model  flutter  suppression 
results  are  given  in  reference  6.  The  Boeing  Company,  Wichita  Division,  has 
provided  contractual  assistance  during  both  the  delta-wing  and  B-52  model 
studies.  The  third  model  study  was  also  done  in  cooperation  with  the  Air  Force 
and  used  a 1/22-size  C-5A  model.  Under  contract  to  the  Air  Force,  the  Lockheed- 
Georgia  Company  designed  and  built  the  model,  and  provided  technical  support 
for  the  wind-tunnel  tests.  The  model  was  equipped  with  an  active  lift  distri- 
bution control  system  (ALDCS)  which  used  active  controlled  ailerons  and 
horizontal  tail  to  redistribute  the  dynamic  wing  loading  in  order  to  decrease 
the  wing  root  bending  moment.  This  C-5A  model  study  was  performed  in  conjunc- 
tion with  the  development  of  a proposed  lift  distribution  control  system  for 
the  full-scale  aircraft.  The  evolution  of  the  proposed  aircraft  system  is 
described  in  reference  7 . 


DELTA  WING  FLUTTER  SUPPRESSION  STUDY 


General 

The  delta-wing  model  study  was  the  first  active  control  flutter  suppres- 
sion study  undertaken  at  the  Langley  Research  Center.  In  general,  this  program 
was  initiated  to  develop  the  basic  technology  required  for  active  control 
modeling  studies  and,  in  particular,  to  demonstrate  experimentally  that  flutter 
can  be  suppressed  by  using  active  controlled  aerodynamic  surfaces.  The  flutter 
suppression  concept  chosen  for  implementation  was  the  aerodynamic  energy  method 
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developed  by  Nisslm  (ref.  4).  Simply  stated,  this  aerodynamic  energy  concept 
says  that  flutter  cannot  occur  if,  for  all  allowable  oscillatory  motions,  posi- 
tive work  is  done  by  the  wing  on  the  surrounding  airstream.  That  is,  energy 
is  transferred  from  the  wing  to  the  airstream. 

A photograph  of  the  delta-wing  model  mounted  in  the  transonic  dynamics 
tunnel  is  presented  in  figure  1,  and  model  geometry  is  shown  in  figure  2.  The 
1.28  aspect  ratio  model  planform  was  a cropped  delta  with  a leading-edge  sweep- 
back  angle  of  50.5®,  a taper  ratio  of  0.127,  and  a circular  arc  airfoil  section 
with  a thickness-to-chord  ratio  of  0.03.  Two  high-fineness  ratio  bodies  were 
mounted  on  the  wing  lower  surface  to  simulate  engine  nacelles.  The  model  was 
cantilever  mounted  to  a rigid  mounting  block  that  was  bolted  to  the  tunnel 
sidewall.  The  mounting  block  was  enclosed  in  a simulated  fuselage  fairing 
which  extended  ahead  of  and  behind  the  wing.  This  mounting  arrangement  brought 
the  wing  root  outside  of  the  tunnel  wall  boundary  layer.  The  model  was 
equipped  with  leading-  and  trailing-edge  aerodynamic  control  surfaces.  The 
controls  were  actuated  by  an  electrohydraulic  system  which  was  controlled  by  a 
feedback  system  that  was  implemented  on  an  analog  computer  located  in  the 
tunnel  control  room. 


Design  and  Construction  Considerations 

Design.-  Since  the  delta-wing  study  was  of  a research  nature,  it  was  not 
necessary  that  the  model  scale  any  particular  full-scale  airplane  wing.  How- 
ever, for  research  studies  to  be  as  relevant  as  possible,  it  is  desirable  that 
the  models  used  be  representative  of  current  or  proposed  configurations.  Con- 
sequently, the  delta-wing  model  design  was  based  on  a contemporary  supersonic 
transport  configuration.  In  particular,  this  model  was  a simplified  1/17-size 
version  of  the  Boeing  2707-300  configuration.  The  design  objective  was  to  have 
a model  that  had  similar  flutter  characteristics  to  those  of  the  prototype  and 
would  flutter  well  within  the  operating  boundary  of  the  transonic  dynamics 
tunnel.  Other  constraints  to  the  model  design  were  that  the  construction  tech- 
nique was  to  be  as  simple  as  practical  and  that  construction  cost  was  to  be 
kept  to  a minimum.  In  developing  the  delta-wing  final  design,  some  preliminary 
wind-tunnel  studies  were  made  by  using  different  size  models  that  differed  from 
one  another  in  stiffness  and  mass  properties.  Some  results  of  this  study  are 
reported  in  reference  8.  From  the  results  of  this  study  a final  design  was 
selected.  The  flutter  boundary  of  the  final  design  (called  configuration  C in 
ref.  8)  is  very  similar  to  the  boundary  (for  one  weight  condition)  of  a rather 
expensive  dynamically  scaled  replica-type  model  of  the  prototype  configuration 
when  both  sets  of  data  are  scaled  to  airplane  values . 

Cons  true t ion . - The  construction  of  the  delta-wing  model  was  relatively 
simple.  The  basic  structure  was  an  aluminum  alloy  insert  which  tapered  in 
thickness  in  the  spanwise  direction.  Portions  of  the  insert  were  chemically 
milled  to  simulate  spars  and  ribs.  The  insert  was  covered  with  balsa  wood 
that  was  contoured  to  give  the  desired  airfoil  section.  The  balsa  wood  was 
covered  with  one  layer  of  fiber  glass  cloth  which  was  doped  to  the  wood.  The 
two  engine  nacelles  were  made  of  steel  tubing  with  balsa  wood  nose  and  tail 
streamlining  fairings.  The  nacelles  were  ballasted  with  lead  weights  to  give 


833 


the  desired  mass  and  inertia  properties.  Relative  to  the  basic  wing  strueture, 
the  nacelles  were  rigid.  The  fuselage  fairing  was  constructed  of  wood.  The 
basic  structure  of  the  leading-  and  trailing-edge  control  surfaces  was  a metal 
tubing  axle  with  balsa  wood  bonded  to  the  axle.  Two  hardwood  ribs  were 
incorporated  in  each  surface  to  provide  additional  chordwise  stiffness.  Each 
control  surface  was  covered  with  a thin  sheet  of  fiber  glass  cloth  that  was 
doped  into  place. 


Flutter  Suppression  System  ^ 

The  flutter  suppression  system  implemented  on  the  delta-wing  model  was 
based  on  the  aerodynamic  energy  concept  described  in  reference  4.  The  imple- 
mentation of  this  method  used  both  leading-edge  and  trailing-edge  control 
surfaces.  The  deflections  of  these  control  surfaces  are  related  to  the  dynamic 
motions  of  the  wing  through  a control  law  which  relates  control  surfaces 
rotations  to  wing  displacement  and  rotation.  The  resulting  matrix  equation  is 
shown  in  figure  3.  The  elements  of  the  C and  G matrices  are  real  numbers  whose 
magnitudes  are  determined  by  aerodynamic  energy  considerations.  In  theory  it 
is  possible  to  determine  values  of  the  C and  G matrix  elements  so  that  for  all 
allowable  wing  motions  energy  is  always  transferred  from  the  wing  to  the 
surrounding  airstream  and  flutter  cannot  occur.  However,  in  practice  it  is  not 
necessary  that  flutter  be  precluded  from  occurring  at  all  flight  conditions, 
but  only  that  the  flutter  speed  be  increased  by  some  predetermined  amount. 

That  is,  flutter  cannot  occur  within  some  specified  flight  envelope. 

Control  lav7S.-  Three  different  control  laws  were  used  for  the  delta-wing 
model.  The  three  control  laws  are  shown  in  figure  4.  The  first  two  (A  and  B) 
used  both  leading-edge  and  trailing-edge  control  surfaces.  Control  Law  C used 
only  a trailing-edge  surface.  Since  the  initial  part  of  the  study  was  aimed 
at  demonstrating  the  basic  aerodynamic  energy  concept,  the  first  control  law 
(Control  Law  A)  used  was  that  given  in  reference  4.  The  values  used  for  the 
C and  G matrix  elements  were  the  same  as  those  Nissim  developed  by  using  two- 
dimensional  unsteady  aerodynamic  theory.  Control  Law  B was  similar  to  the 
first  except  that  three-dimensional  unsteady  aerodynamic  theory  (doublet 
lattice  method)  was  used  to  determine  the  terms  in  the  C and  G matrices.  Con- 
trol Law  C was  also  developed  by  using  three-dimensional  aerodynamics,  but  used 
only  the  trailing-edge  control  surface.  In  implementing  both  Control  Laws  B 
and  C on  the  model,  some  difficulties  were  encountered.  In  effect,  the 
system  was  so  sensitive  that  if  the  model  was  disturbed  in  still  air  the  con- 
trol surfaces  would  begin  to  oscillate  and  drive  the  model.  The  exact  reason 
for  this  problem  has  not  been  determined,  but  it  is  believed  to  be  due  to 
inertia  coupling  between  the  control  surface  and  the  wing  portion  of  the  model. 
This  difficulty  was  cured  by  compromising  the  analytical  values  for  the  coef- 
ficients in  the  G matrix.  The  original  G matrix  values  are  shown  in  parentheses 
in  figure  4.  Analytical  study  results  indicated  that  the  required  adjustment 
in  G matrix  values  had  little  effect  for  Control  Law  C.  However,  for  Control 
Law  B there  was  a considerable  degradation  of  the  expected  flutter  dynamic 
pressure  increase  when  the  G matrix  values  were  decreased.  However,  Control 
Law  B still  gave  better  performance  in  terms  of  increase  in  flutter  dynamic 
pressure  than  that  calculated  for  Control  Law  A. 
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Implementation . - Some  of  the  physical  components  of  the  flutter  suppres- 
sion system  are  shown  in  the  photograph  presented  in  figure  5*  A simplified 
block  diagram  of  the  system  is  presented  in  figure  6*  The  wing  motion  was 
sensed  by  two  accelerometers  that  were  located  in  line  with  the  inboard  edges 
of  the  control  surfaces.  The  accelerometers  were  located  at  30  and  70  percent 
of  the  chord.  The  accelerometer  output  signals  were  fed  through  signal  con- 
ditioning equipment  to  an  analog  computer  which  was  located  in  the  tunnel 
control  room.  The  aerodynamic  energy  control  law  was  programed  on  the  analog 
computer.  The  integration  and  differencing  operations  required  to  process 
the  acceleration  signals  were  also  programed  on  the  computer.  (A  portion  of 
the  analog  computer  may  be  seen  in  the  upper  left  of  figure  5.)  The  analog 
computer  processed  the  accelerometer  signals  to  determine  appropriate  actuator 
command  signals.  Command  signals  were  passed  to  hydraulic  servovalves  which 
were  mounted  in  the  fuselage  fairing  at  the  model  root.  The  servovalves  con- 
trolled the  supply  of  hydraulic  fluid  to  miniature  actuators  that  were  mounted 
in  the  model  at  the  inboard  edge  of  each  control  surface.  Control  surface 
angular  position  was  determined  by  using  miniature  silicon  solar  cells  attached 
to  each  actuator  shaft.  Hydraulic  and  electric  lines  were  routed  to  the 
actuators  and  sensors  in  trenches  cut  into  the  balsa  wood  which  covered  the 
aluminum  insert.  The  model  was  also  equipped  with  several  resistance  wire 
strain-gage  bridges  which  were  used  to  monitor  model  response.  Although  it  is 
not  indicated  in  figure  6,  provision  was  provided  for  introducing  external 
command  signals  to  the  control  surfaces.  External  command  signals  to  the 
trailing-edge  surface  were  used  for  performing  frequency  sweeps  and  could  be 
introduced  with  the  flutter  suppression  system  either  operating  (closed-loop) 
or  not  operating  (open-loop) . 

Control  surface  actuators.-  Initially  it  was  decided  to  mechanize  the 
control  actuation  system  with  an  electromechanical  system.  The  original  con- 
cept was  to  mount  an  electric  torque  motor  external  to  the  model  (inboard  of 
the  model  root)  and  transmit  the  torque  to  the  control  surface  by  mechanical 
shafting.  Considerable  design  effort  with  accompanying  laboratory  experimenta- 
tion was  expended  in  trying  to  come  up  with  a satisfactory  electromechanical 
system  with  little  success.  The  major  difficulty  was  associated  with  the 
shafting  which  had  to  exhibit  little  wind-up  yet  be  light  weight  and  not  con- 
tribute any  appreciable  increase  in  stiffness  to  the  basic  wing.  Finally,  it 
was  decided  to  switch  to  a hydraulic  actuation  system  with  the  actuators 
located  in  the  model  at  the  control  surfaces.  Since  no  miniature  hydraulic 
actuators  existed  that  were  small  enough  to  fit  within  the  model  aerodynamic 
contour  and  provide  the  required  torque,  not  to  mention  the  light  weight 
requirement,  it  was  necessary  to  design  and  fabricate  special  actuators.  The 
actuator  design  and  fabrication  is  described  in  reference  9.  The  actuator  is 
essentially  a closed  compartment  that  is  separated  into  two  chambers  by  a vane 
which  rotates  on  a shaft  that  attaches  to  the  control  surface  axle.  The  amount 
of  shaft  rotation  is  determined  by  the  difference  in  hydraulic  pressure  between 
the  two  chambers.  The  actuator  weighs  56.7  grams  (0.125  lb)  and  is  capable 
of  providing  a 4.52  N-M  (40  in-lb)  torque  output  with  a 6.9  x 10^  kN/m^ 

(1000  Ib/in^)  supply  pressure  over  the  frequency  range  from  0 to  25  Hz.  A 
photograph  of  an  assembled  actuator  attached  to  the  trailing-edge  control  sur- 
face is  presented  in  figure  7.  The  development  of  these  miniature  actuators 
represents  a significant  contribution  to  active  control  modeling  and  is  not 
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limited  to  the  delta-wing  model  application.  In  fact,  similar  actuators  were 
used  in  the  C-5A  study  to  be  discussed  later  in  this  paper.  It  was  also 
necessary  to  design  and  fabricate  special  control-surface  position  indicators. 
Here  again  the  space  available  was  one  of  the  most  significant  design  con- 
straints, The  new  position  sensor  (ref,  9)  is  a rather  simple  device  that 
uses  two  silicon  solar  cells  that  are  mounted  on  a common  base  that  is 
attached  to  the  actuator  shaft*  The  solar  cells  are  illuminated  by  a sta- 
tionary light  source.  The  intensity  of  the  illumination  changes  as  the  shaft 
rotates j and  a voltage  is  produced  which  is  linearly  proportional  to  the 
tangent  of  the  shaft  rotational  angle. 

Control  surface  location.-  Since  the  specific  aerodynamic  energy  control 
law  developed  in  reference  4 was  based  on  two-dimensional  unsteady  aerodynamic 
theory,  it  was  necessary  to  conduct  an  analytical  study  to  determine  an 
appropriate  location  for  the  control  surfaces.  This  study  is  described  in 
reference  10,  and  some  of  the  results  are  shown  here  in  figure  8,  Three  pos- 
sible control  surface  locations  were  considered  as  well  as  different  locations 
of  the  model  motion  accelerometer  sensors.  In  all  cases  the  accelerometers 
were  located  at  30  and  70  percent  of  the  local  chord.  The  combination  of 
control  surface  and  sensor  locations  used  for  the  delta-wing  model  was  the  mid- 
span surfaces  with  the  accelerometers  alined'  with  the  inboard  edge  of  the 
surfaces.  This  combination  gave  the  second  best  increase  in  flutter  dynamic 
pressure.  The  most  improvement  was  obtained  for  outboard  control  surfaces  and 
outboard  sensor  locations,  but  the  use  of  this  combination  would  have  been  very 
difficult  since  the  wing  was  very  thin  in  this  region.  It  should  be  pointed 
out  that  the  mathematical  model  used  to  generate  the  data  presented  in  figure  8 
was  slightly  different  from  the  final  delta-wing  model  so  the  expected  flutter 
dynamic  increase  for  the  model  would  not  be  expected  to  be  exactly  those 
shown  in  the  figure. 


Test  Techniques 

Wind  tunnel.-  As  was  the  case  for  all  of  the  model  studies  described  in 
this  paper,  the  delta-wing  model  was  tested  in  the  Langley  Research  Center 
transonic  dynamics  tunnel.  This  facility  is  specially  designed  for  and  almost 
totally  dedicated  to  the  testing  of  dynamic  aeroelastic  models.  The  closed- 
circuit,  single-return  tunnel  has  a 4,88-m  (16-foot)  rectangular  test  section 
with  flow  expansion  slots  in  all  four  walls.  The  tunnel  flow  conditions  are 
continuously  controllable  over  the  Mach  number  range  from  about  0.07  to  1.2  at 
total  pressures  from  near  vacuum  to  slightly  above  one  atmosphere.  Either  air 
or  freon  may  be  used  as  the  test  medium.  All  results  reported  herein  were 
obtained  by  using  freon. 

Subcritical  response,-  In  active  flutter  suppression  studies  it  is  not 
only  desirable  to  determine  actual  flutter  data  points,  but  it  is  also  neces- 
sary to  determine  stability  information  at  conditions  below  the  flutter 
boundary.  The  desired  information  is  the  damping  of  the  critical  flutter  mode. 
Two  techniques  have  been  used  with  considerable  success  for  determining  sub- 
critical  damping  levels.  Both  methods  are  based  on  the  assumption  that  the 
response  is  that  of  a single-degree-of-f reedom  system.  The  first  technique  is 
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based  on  the  procedure  described  in  reference  11  and  is  referred  to  as 
"randomdec,”  Unlike  most  subcritical  response  procedures,  randomdec  does  not 
require  that  the  system  be  excited  by  special  shakers,  but  depends  on  flow 
turbulence  to  supply  the  necessary  input.  The  randomdec  method  is  illustrated 
schematically  in  figure  9.  The  system  response  is  assumed  to  be  composed  of 
three  components  - the  responses  to  a step,  to  an  impulse,  and  to  a stationary 
random  force.  The  system  response  to  a step  force  is  obtained  by  an  ensemble 
average  of  a number  of  time  sweeps,  since  the  response  to  an  impulse  and  to  a 
random  force  average  to  zero.  The  time  averaging  was  accomplished  by  using  a 
small  special-purpose  computer.  In  the  implementation  here  the  different  time 
segments  were  averaged  sequentially.  That  is,  the  computer  processed  all  the 
results  for  one  time  sample  before  beginning  to  collect  the  average  data  for 
the  next  sample.  The  averaging  process  for  each  time  sample  was  started  when 
the  output  signal  reached  a predetermined  level.  The  model  sensor  output  was 
passed  to  a gating  circuit.  When  the  preset  signal  level  was  reached,  the  gate 
was  opened  and  the  signal  passed  to  the  computer  and  averaged  with  values  from 
previous  samples.  Electronic  filters  were  used  to  isolate  the  frequencies  of 
modes  of  interest.  The  averaged  signal  has  the  appearance  of  the  damped  oscil- 
lation of  a single-degree-of-f reedom  system.  The  system  damping  is  obtained 
from  this  decaying  oscillation.  Although  the  randomdec  method  has  been  used 
quite  successfully  in  many  cases  to  determine  subcritical  damping  level,  the 
method  is  not  free  from  p"roblems.  Two  difficulties  are  worthy  of  mention  here. 
The  first  is  noise  contamination  of  the  signal.  At  low  levels  of  flow  turbu- 
lence, the  output  of  the  model  response  sensor  is  relatively  low.  However, 
since  the  electronic  noise  level. is  independent  of  sensor  output,  the  signal- 
to-noise  level  is  relatively  low  and  the  result  is  low-quality  decay  signatures 
Fortunately,  this  difficulty  is  most  severe  at  conditions  removed  from  the 
flutter  condition.  As  the  flutter  condition  is  approached  the  system  response 
naturally  increases  and  the  signal-to-noise  level  increases.  The  second  prob- 
lem is  when  there  are  two  or  more  structural  frequencies  in  close  proximity 
to  one  another.  Although  signal  filtering  is  useful,  it  is  very  difficult  to 
completely  filter  out  the  unwanted  mode.  Although  the  band-pass  filter  is  set 
for  a very  narrow  range  of  frequency,  the  signal  level  outside  the  band  is  not 
completely  attenuated  because  of  filter  roll-off.  This  results  in  a beat 
occurring  in  the  randomdec  decay  signature  and  makes  determining  quantative 
values  of  the  damping  difficult.  The  decay  looks  like  that  of  a coupled  two- 
degree-of-freedom  system. 

The  second  technique,  described  in  more  detail  in  reference  12,  requires 
the  measuring  of  the  forced  response  of  the  model.  This  method  is  illustrated 
schematically  in  figure  10  and  will  be  referred  to  as  the  Co-Quad  method.  The 
model  is  excited  by  a sinusoidal  force  of  varying  frequency  and  the  correspond- 
ing dynamic  response  is  measured.  Special  electronic  equipment  is  used  to 
resolve  the  response  into  in-phase  (called  Co  for  coincident)  and  out-of-phase 
(called  Quad  for  quadrature)  components  relative  to  the  sinusoidal  command 
signal.  The  damping  of  the  system  is  obtained  for  each  structural  mode  from 
the  variation  of  the  coincident  component  transfer  function  with  frequency. 

Each  resonant  condition  is  treated  as  if  it  were  that  of  a single-degree-of- 
freedom  response,  and  the  damping  is  obtained  by  using  the  formula  shown  in 
the  figure.  For  active  control  models  the  Co-Quad  method  is  easily  implemented 
since  an  active  controlled  aerodynamic  surface  can  be  used  to  provide  the 
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sinusoidal  force  input.  For  the  delta-wing  model  frequency  response  data  were 
obtained  by  oscillating  the  trailing-edge  control  surface.  Co-Quad  response 
data  were  obtained  in  terms  of  the  ratio  of  accelerometer  output  h^  to  command 
signal  6^  ^ to  the  trailing-edge  control.  The  difficulties  encountered  with 
this  method  were  similar  to  those  described  for  the  randomdec  method,  namely, 
noise  and  closely  spaced  resonant  frequencies.  However,  in  contrast  to 
randomdec,  the  noise  in  this  case  is  not  primarily  instrumentation  noise  but 
is  the  random  response  of  the  model  which  is  superimposed  on  the  sinusoidal 
response.  The  Co-Quad  method  requires  a longer  data  gathering  period  than  the 
randomdec  technique.  Typically  about  30  seconds  were  required  for  randomdec 
while  the  Co-Quad  frequency  sweeps  of  about  4 minutes  were  used.  The  Co-Quad 
method  is  somewhat  dangerous  to  use  at  conditions  very  near  the  flutter  condi- 
tion since  the  addition  of  the  sinusoidal  force  to  a model  that  already  has 
significant  response  results  in  extremely  large  amplitudes  as  the  forcing  fre- 
quency sweeps  through  the  critical  flutter  mode. 

For  the  delta-wing  model  both  the  randomdec  and  Co-Quad  methods  were  suc- 
cessfully used.  In  general,  the  randomdec  method  appeared  to  be  the  better  of 
the  two  methods.  The  randomdec  results,  as  judged  by  the  qualitative  appearance 
of  the  randomdec  decay  signature,  appear  to  get  better  as  flutter  condition  is 
approached.  In  contrast  the  Co-Quad  method  appeared  to  give  the  best  results 
the  farther  you  were  away  from  the  flutter  condition.  Where  damping  data  were 
obtained  by  using  both  methods,  the  results  were  within  what  would  be  expected 
to  be  the  experimental  scatter  band. 


Results 

Flutter.-  Flutter  studies  of  the  delta-wing  model  were  conducted  at  Mach 
numbers  M of  0.6,  0.7,  0.8,  and  0.9.  Tests  were  performed  both  with  (closed- 
loop)  and  without  (open-loop)  active  controls.  For  the  open-loGp  studies  the 
control  surfaces  were  kept  at  0®  deflection  by  applying  hydraulic  pressure  to 
the  actuators.  The  pressurized  system  acted  as  a stiff  spring  to  keep  the 
rotational  frequency  of  each  control  surface  many  times  higher  than  the  wing 
flutter  frequency.  Once  the  open-loop  flutter  boundary  of  the  wing  was 
established,  an  evaluation  of  the  effects  of  each  of  the  three  control  laws  on 
raising  the  boundary  was  made.  However,  studies  for  Control  Laws  A and  B were 
restricted  to  M = 0.9  because  of  a high-frequency,  large-amplitude  oscilla- 
tion of  the  leading-edge  control.  This  phenomenon  occurred  around  65  Hz,  as 
compared  to  the  flutter  frequency  of  from  11  to  12.5  Hz.  It  is  believed  that 
oscillatory  motion  was  introduced  in  some  manner  by  the  mechanization  of  the 
leading-edge  control,  and  was  not  a consequence  of  the  control  law,  since  the 
motion  was  also  observed  to  a lesser  degree  with  the  control  loop  open. 

A comparison  of  calculated  and  experimental  results  showing  the  effect  of 
each  control  law  on  raising  the  open-loop  flutter  boundary  is  presented  in 
figure  11.  The  results  are  presented  in  terms  of  percent  increase  in  dynamic 
pressure  at  M = 0.9.  By  using  Control  Law  A a 12-percent  increase  in  dynamic 
pressure  was  obtained.  The  observed  flutter  motions  for  both  open-  and 
closed-loop  operations  were  similar.  The  calculated  increase  for  Control  Law  A 
is  in  excellent  agreement  with  the  experimental  values . An  earlier  analytical 
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treatment  for  this  eontrol  law  was  reported  in  reference  3 and  showed  a 
21-percent  increase  in  the  flutter  dynamic  pressure.  The  differences  between 
theory  and  experiment  in  reference  3 were  attributed  in  part  to  the  inability 
of  the  aerodynamic  theory  to  adequately  predict  control  surface  pressure  dis- 
tributions. Early  in  the  design  of  the  delta-wing  model  static  hinge-moment 
measurements  were  made  to  aid  in  the  design  of  the  control  actuators.  It  is 
shown  in  reference  13  that  the  calculated  values  of  hinge  moment  are  somewhat 
higher  than  those  that  were  measured.  For  the  present  analytical  investigation 
the  theoretical  unsteady  aerodynamic  forces  for  the  leading-  and  trailing-edge 
control  surfaces  were  adjusted  to  take  into  account  the  differences  between 
measured  and  calculated  static  hinge  moments.  The  analytical  results  for 
Control  Law  B indicate  a predicted  increase  of  24  percent.  The  experimental 
results  demonstrate  a minimum  increase  of  22  percent.  Experimental  results  for 
Control  Law  B do  not  represent  a closed-loop  flutter  point  since  further 
increases  in  dynamic  pressure  were  restricted  by  the  high-frequency  oscillation 
of  the  leading-edge  control  surface  mentioned  earlier.  Of  the  three  control 
laws  investigated,  the  largest  increase  in  flutter  dynamic  pressure  was 
obtained  with  Control  Law  C.  A minimum  increase  in  dynamic  pressure  of  30  per- 
cent was  obtained  with  this  control  law.  The  model  was  not  tested  to  the 
closed-loop  flutter  condition  since  the  goal  for  these  tests  was  set  at  a 
30-percent  increase  in  dynamic  pressure  assuming  that  closed-loop  flutter  was 
not  encountered.  The  analytical  results  indicate  a 34-percent  increase. 

The  effectiveness  of  Control  Law  C in  suppressing  the  flutter  motion  is 
vividly  demonstrated  by  the  time  history  of  the  wing  bending  strain-gage  out- 
put shown  in  figure  12.  Time  is  increasing  from  left  to  right.  The  tunnel 
dynamic  pressure  was  slowly  increased  until  open-loop  flutter  occurred  (see 
left  of  figure) . At  this  point  the  flutter  suppression  system  was  turned  on 
as  is  indicated  by  the  vertical  dashed  line  on  the  right  side  of  the  figure. 

Note  that  when  the  system  is  turned  on,  oscillatory  flutter  motion  is  rapidly 
damped  to  a closed-loop  no-flutter  condition.  The  degree  of  confidence  in  the 
control  system  was  such  that  when  open-loop  flutter  was  encountered,  the  active 
control  loop  was  closed  to  suppress  the  motion. 

In  order  to  evaluate  the  active  control  system  at  other  Mach  numbers. 
Control  Law  C was  both  analytically  and  experimentally  studied  from  M = 0.6 
to  M = 0.9.  The  results  obtained  are  presented  in  figure  13  in  terms  of  the 
variation  of  flutter-speed- index  parameter  with  Mach  number.  The  experimentally 
measured  open-loop  flutter  boundary  and  the  closed-loop  no-flutter  points  for 
each  Mach  number  are  presented.  At  M = 0.8  a 9.4-pereent  increase  in  flutter- 
speed-  index  (20  percent  in  d3mamic  pressure)  is  shown.  Unfortunately,  at  this 
point  the  model  was  damaged  due  to  saturation  of  the  closed-loop  system  because 
of  limited  available  actuator  angles  (±9®).  Saturation  caused  the  analog  com- 
puter amplifiers  to  overload  and  forced  the  control  surface  to  go  hard  against 
its  stop  resulting  in  open-loop  flutter.  The  model  was  repaired  and  tested  at 
Mach  numbers  of  0.7  and  0.6.  A modest  increase  in  flutter-speed- index  of 
5.7  percent  (12  percent  in  dynamic  pressure)  was  demonstrated  at  these  two 
Mach  numbers. 

A comparison  of  calculated  and  experimental  results  (Control  Law  C)  is 
also  presented  in  figure  13.  The  calculations  for  the  open-loop  system  show 
reasonable  agreement  at  all  Mach  numbers. 
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Subcritical  response , - Some  subcritlcal  response  data  obtained  by  using 
the  Co-Quad  technique  are  presented  in  figure  14  for  a Mach  number  of  0.90. 

Both  the  in-phase  and  out-of-phase  response  in  terms  of  the  ratio  of  accelerom- 
eter output  h^^  to  trailing-edge  command  signal  ^ are  presented.  The 
curves  on  the  left  of  figure  14  represent  the  model  for  open-loop  operation  at 
a dynamic  pressure  approximately  5 percent  below  the  open-loop  flutter  boundary. 
The  curves  to  the  right  in  this  figure  show  the  model  closed-loop  response 
(Control  Law  C)  at  the  open-loop  flutter  dynamic  pressure.  A qualitative 
measure  of  the  active  controls  in  reducing  the  forced  response  of  the  system 
is  evident  by  the  reductions  in  peak  amplitudes  around  the  flutter  frequency 
of  11  Hz.  Also  shown  in  figure  14  are  calculated  response  data.  Note  that 
the  analysis  does  predict  well  the  general  behavior  of  the  response.  For  these 
calculations,  the  effectiveness  of  the  trailing-edge  control  was  reduced  by  the 
ratio  of  measured- to-calculated  static  hinge  moments. 


B-52  MODEL  STUDY 


General 


The  planned  B-52  model  program  includes  studies  in  four  active  control 
areas.  These  areas  are  flutter  mode  control,  ride  quality  control,  maneuver 
load  control,  and  relaxed  static  stability.  To  date  a portion  of  the  planned 
flutter  mode  control  (FMC)  and  ride  quality  control  (RQC)  tests  have  been 
completed.  The  completed  flutter  suppression  and  ride  quality  control  wind- 
tunnel  tests  are  described  herein.  The  flutter  mode  control  portion  of  the 
model  program  is  being  conducted  in  cooperation  with  the  Air  Force  Flight 
Dynamics  Laboratory  with  contractual  support  being  supplied  in  all  four  areas 
by  The  Boeing  Company,  Wichita  Division. 

The  B-52  model  program  actually  began  in  the  late  1960 's  when  a 1/30-size 
dynamically  scaled  aeroelastic  model  of  the  B-52E  aircraft  was  constructed  for 
use  in  symmetric  gust  studies  in  the  transonic  dynamics  tunnel.  Although  pro- 
vision was  provided  for  incorporation  of  active  controlled  midspan  ailerons 
and  elevator  in  this  original  model,  only  gust  response  studies  without  active 
control  were  conducted.  The  results  from  these  tests  are  not  published.  With 
the  initiation  of  the  B-52  CCV  airplane  program,  it  was  decided  to  convert  the 
B-52E  model  to  a model  of  the  CCV  aircraft  and  expand  the  model  program  to 
include  the  four  active  control  areas  mentioned  above.  The  B-52  CCV  airplane 
program  is  described  in  reference  14,  and  some  flight  results  are  presented  in 
reference  15.  These  CCV  model  tests  offer  the  unique  opportunity  of  validating 
wind-tunnel  model  techniques  since  flight  data  would  be  available  for  comparison 
x-^ith  the  model  results.  Although  some  modifications  to  the  structural  stiffness 
and  mass  were  required  in  converting  the  original  model  to  a CCV  model,  most  of 
the  modifications  were  associated  with  the  installation  of  new  aerodynamic 
control  surfaces  which  included  outboard  ailerons,  flaperons,  and  a pair  of 
fuselage-mounted  horizontal  canards.  A photograph  of  the  complete  free-flying 
model  mounted  on  the  two-cable  suspension  system  in  the  transonic  dynamics 
tunnel  is  presented  in  figure  15. 
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The  objectives  of  the  B~52  model  wind-tunnel  tests  were  to  demonstrate  the 
effectiveness  of  the  FMC  system  and  the  RQG  system,  and  to  obtain  data  for 
correlation  with  analysis  and  airplane  flight  results.  The  design  of  the  model 
systems  was  based  on  the  corresponding  CCV  aircraft  systems.  The  FMC  system 
used  active  controlled  flaperons  and  outboard  ailerons.  A pair  of  fuselage- 
mounted  horizontal  canard  surfaces  was  used  for  the  RQC  system.  The  locations 
of  the  control  surfaces  are  shown  in  figure  16.  The  feedback  loops  for  both 
systems  were  implemented  on  an  analog  computer.  The  model  control  surfaces 
were  actuated  by  using  an  electromechanical  system. 


Design  and  Construction 

Scaling.-  The  B-52  model  was  a 1/30-size  dynamically  scaled  aeroelastic 
model  of  the  B-52  CCV  airplane.  The  model  weighed  about  26  kg  (57.75  lb)  and 
had  a wing  span  of  188  cm  (6.16  ft).  The  model  was  designed  to  match  the 
dynamic  similitude  parameters  of  reduced  wavelength,  mass  ratio,  and  Froude 
number.  Some  of  the  scaling  relationships  and  corresponding  model/airplane 
flight  conditions  are  presented  in  figure  17.  Since  the  airplane  flight  condi- 
tions are  at  relatively  low  Mach  numbers  where  compressibility  effects  are 
small,  it  was  not  considered  necessary  to  match  the  Mach  number  between  the 
airplane  and  the  model.  It  is  fortunate  for  the  B-52  model  study  that  flight 
conditions  were  at  relatively  low  speeds  since  Mach  number  and  Froude  number 
scaling  are  difficult  to  satisfy  simultaneously  while  still  matching  both 
reduced  wavelength  and  mass  ratio.  A discussion  of  the  conflicting  require- 
ments of  Mach  number  and  Froude  number  scaling  is  presented  in  reference  2. 


Construction . - The  construction  technique  used  for  the  B-52  model  was  one 
that  has  been  successfully  used  for  a number  of  years  in  building  aeroelastic 
models.  Some  details  of  the  model  construction  are  shown  in  figure  18. 

Aluminum  alloy  spars  and  beams  were  used  to  provide  the  basic  stiffness  of  the 
wings  and  fuselage,  respectively.  Segmented  pods  constructed  of  wood  frames 
covered  with  thin  plastic  sheets  were  attached  to  the  spars  and  beams  ”to  pro- 
vide the  proper  aerodynamic  contour.  The  empenfiage  was  not  elastically  scaled. 
Both  the  horizontal  and  vertical  tail  were  relatively  stiff,  but  did  have  the 
proper  total  weight  and  center-of-gravity  location.  The  engine  nacelles  were 
rigid  streamlined  bodies  that  had  the  proper  inertia  properties.  The  nacelles 
were  attached  to  the  wing  spars  by  flexible  beams  which  simulated  the  pylon 
stiffness.  External  fuel  tanks  were  attached  near  the  wings  tips.  The  tanks 
were  ballasted  to  simulate  the  mass  that  had  to  be  added  to  the  airplane  to 
produce  a flutter  condition  within  the  airplane  operating  boundary. 


Test  Techniques 

Mounting  system.-  The  B-52  model  was  mounted  in  the  transonic  dynamics 
tunnel  by  using  a modified  version  of  the  two#cable  suspension  system  described 
in  reference  16.  A portion  of  the  cable  support  system  is  shown  in  figure  15. 
The  model  was  supported  by  two  cable  loops,  called  flying  cables,  which  were 
attached  to  the  model  at  a common  point.  The  cables  were  routed  through  low 
friction  pulleys  located  on  the  tunnel  walls . The  forward  cable  loop  was  in 
the  vertical  plane,  and  the  aft  cable  loop  was  in  the  horizontal  plane.  The 
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cables  were  kept  under  tension  by  stretching  a soft  spring  in  the  rear  loop. 

This  mount  system  provided  freedom  for  the  model  to  translate  laterally  and 
vertically  and  to  rotate  about  the  pitch,  roll,  and  yaw  axes.  In  additon  to 
the  flying  cables,  four  additional  cables  were  attached  to  the  model  to  provide 
emergency  restraint  (see  fig.  15).  These  snubber  cables  extended  out  through 
the  tunnel  walls  to  a shock  absorber  system  and  a remotely  controlled  actuator. 
These  cables  were  slack  during  normal  test  operations.  The  model  was  essentially 
flown  in  the  tunnel  test  section  on  the  mount  system  by  a pilot  located  in  the 
tunnel  control  room.  For  this  model  the  pilot  remotely  operated  the  horizontal 
stabilizer  to  provide  pitch  control.  For  many  models,  external  roll  control  is 
also  provided,  but  this  was  not  done  for  the  B-52  model.  Proper  roll  attitude 
(wings  level)  was  obtained  by  manually  setting  small  trim  tabs  located  on  each 
wing  by  a trial-^and-^error  process.  Once  a satisfactory  tab  setting  was  obtained 
during  the  first  test  run,  it  was  not  necessary  to  change  the  setting  for  later 
runs. 


For  flutter  model  testing  the  primary  mount  system  design  requirements  are 
that  the  model  must  be  stable  on  the  mount  system,  and  that  the  frequencies  of 
all  rigid  body  modes  must  be  well  separated  from  the  frequencies  of  the  struc- 
tural modes.  For  longitudinal  ride  quality  control  studies,  there  is  the  addi- 
tional requirement  that  the  short-period  mode  must  be  simulated  as  accurately 
as  possible.  Since  the  two-cable  system  introduces  some  spring  restraints  to 
the  model  that  do  not  exist  in  free  flight,  the  short-period  mode  is  affected, 
and  an  additional  rigid  body  mode  (primarily  a vertical  translation  mode)  is 
added.  In  designing  the  B-52  model  mount  system,  particular  attention  was  given 
to  properly  simulating  the  airplane  short-period  mode  and  to  keeping  of  the 
rigid  body  translational  mode  frequency  as  low  as  possible. 

Flutter  mode  control  (FMG)  For  the  most  part  the  wind-tunnel  test  tech- 
niques used  for  the  B-52  model  FMC  studies  were  the  same  as  those  used  for  the 
delta  wing.  Both  the  randomdec  and  Co-Quad  subcritical  response  techniques 
were  used.  Some  additional  techniques  were  also  used  in  an  effort  to  determine 
subcritical  damping  from  transient  response  data.  In  one  technique  the  model 
was  disturbed  by  sinusoidally  driving  the  aileron  and  then  abruptly  removing 
the  driving  force  to  give  a transient  response.  In  another  method  a transient 
response  was  generated  by  driving  the  elevator  with  a one-cycle  sine  wave  pulse. 
Neither  of  these  two  methods  was  very  satisfactory  for  determining  damping  data 
since  the  transient  response  was  almost,  sometimes  totally,  obscured  by  the 
response  of  the  model  to  tunnel  turbulence.  It  is  interesting  to  mention  that 
transient  response  methods  were  satisfactorily  used  to  determine  damping  during 
the  B-52  CCV  flight  tests.  Apparently  the  ratio  of  turbulence  response  to 
control  surface  input  response  was  higher  for  the  model  than  for  the  airplane. 
The  lack  of  success  with  transient  methods  for  the  B-52  model  does  not  mean  that 
transient  response  damping  determination  techniques  cannot  be  developed  for 
model  use,  but  rather  means  that  more  development  work  needs  to  be  done. 

Ride  quality  control  (RQC).-  Part  of  the  RQC  tests  were  accomplished  by 
using  an  airstream  oscillator  system  to  provide  a symmetric  sinusoidal  gust 
input  to  the  model.  The  oscillating  vane  system  consists  of  a set  of  biplane 
vanes  installed  on  each  side  wall  in  the  entrance  cone  to  the  tunnel  test  sec- 
tion. The  vane  system  is  shown  in  figure  19.  The  vanes  are  sinusoidally 
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oscillated  (either  syiniaetrically  or  antisyinmetrically)  through  mechanical 
linkages  by  a hydraulic  motor  and  flywheel  arrangement.  A vertical  velocity 
component  is  induced  in  the  flow  in  the  center  portion  of  the  test  section 
by  the  trailing  vortices  from  the  vane  tips.  The  installation  and  early  use  of 
the  vane  system  in  the  transonic  dynamics  tunnel  is  described  in  reference  17. 
The  gust  vane  system  has  been  calibrated  and  some  typical  results  are  presented 
in  figure  20  in  the  form  of  a contour  plot.  The  data  shown  are  the  variation 
of  flow  angle  of  attack  with  frequency  and  lateral  position  across  the  tunnel. 
Note  that  the  gust  angle  decreases  rapidly  with  increasing  frequency  and  that 
there  is  some  variation  in  flow  angle  with  lateral  position.  Model  response 
measurements  were  made  with  the  RQS  system  on  and  off  while  the  airstream 
oscillator  system  frequency  was  varied  from  1 to  16  Hz.  Also,  frequency  sweeps 
were  made  using  external  sinusoidal  command  signals  to  the  model  canards.  The 
canard  frequency  was  continuously  varied  over  the  frequency  range  from  4 to 
24  Hz.  Transfer  functions  were  determined  using  the  Co-Quad  technique. 


Active  Control  Systems 


The  B-52  model  used  active  controlled  outboard  ailerons  and  flaperons  for 
the  FMC  system.  A pair  of  horizontal  canards  were  used  for  the  RQC  system. 

The  actuation  systems  for  all  of  these  surfaces  were  of  the  electromechanical 
type  as  opposed  to  the  electrohydraulic  system  used  on  the  airplane.  The  con- 
trol surfaces  were  actuated  by  electric  torque  motors  mounted  in  the  model 
fuselage.  The  motors  mechanically  connected  to  the  control  surf^es  through  a 
rather  complex  mechanism  of  linkages.  The  complexity  of  the  system  can  be  seen 
by  examining  the  photograph  shown  in  figure  18.  A more  detailed  description  of 
the  actuation  system  is  presented  in  reference  10.  The  control  laws  were 
implemented  and  an  analog  computer  located  in  the  tunnel  control  room.  Each 
control  law  was  wired  to  a separate  removable  patch  panel.  { 

FMC  system.-  The  design  of  the  FMC  system  was  based  on  the  results  of 
previous  experience  and  analyses  of  the  B-52  airplane.  These  results  indicated 
that  stabilizing  aerodynamic  forces  are  produced  over  the  entire  flutter  oscil- 
lation cycle  when  the  incremental  lift  generated  by  the  control  surfaces  lags 
"^the  wing  displacement  by  90°.  Thus,  the  FMC  feedback  system  was  designed  to 
produce  the  required  phase  lag  between  lift  and  displacement  at  tha  flutter 
frequency.  The  airplane  FMC  system  is  described  in  reference  18.  A simplified 
block  diagram  of  the  model  FMC  system  is  presented  in  figure  21.  The  FMC  system 
was  redundant  since  there  were  two  independent  feedback  loops.  The  first  loop 
used  the  outboard  ailerons  as  the  active  aerodynamic  surfaces.  Accelerometer 
signals  from  both  the  left  and  right  wings  were  averaged  and  passed  through  a 
shaping  filter  to  generate  the  aileron  feedback  command  signal  which  was  routed 
to  the  single  aileron  actuator.  The  flaperon  loop  was  similar  to  the  aileron 
loop  except  that  each  flaperon  had  its  own  actuator.  In  concept  the^^ model  and 
B-52  CCV  airplane  systems  are  the  same,  the  only  difference  is  in  the  actuator 
dynamic  characteristics.  That  is,  a comparison  of  the  two  transfer  functions 
would  show  a difference.  However,  over  the  frequency  range  of  interest,  the  two 
actuators  do  have  similar  dynamic  characteristics.  Note  that  provision  was  pro- 
vided at  summing  junctions  (see  upper  left  of  fig.  21)  for  introducing  external 
command  signals  to  the  actuators.  The  external  command  signals  were  used  to 
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drive  the  control  surfaces  for  model  excitation.  The  command  signals  can  be 
used  when  the  FMC  system  is  either  operating  (closed-loop)  or  not  operating 
(open-loop). 

RQC  system.-  The  RQC  system  was  designed  to  provide  about  a 30-percent 
reduction  in  the  RMS  vertical  acceleration  level  at  the  pilot’s  station.  A 
simplified  block  diagram  of  the  RQS  system  is  presented  in  figure  22.  Pilot 
station  acceleration  signals  are  fed  back  through  a shaping  filter  to  produce 
the  required  canard  command  signals.  In  the  RQC  system  it  was  necessary  to  add 
compensation  to  account  for  the  differences  in  dynamic  characteristics  between 
the  model  and  airplane  actuators.  The  design  of  the  model  RQC  system  is 
described  in  reference  19. 


B-52  Results 

FMC  system.-  The  primary  objectives  of  the  model  FMC  system  studies  were 
to  establish  the  open-loop  (FMC  off)  flutter  velocity,  to  demonstrate  the 
ef fectiveness  of  the  closed- loop  system  (FMC  on) , and  to  obtain  data  for  cor- 
relation with  model  analysis  and  full-scale  flight  tests. 

During  the  FMC  studies  the  open-loop  flutter  velocity  was  determined,  and 
both  open-  and  closed-loop  subcritical  response  measurements  were  made  above 
and  below  the  open-loop  flutter  velocity.  As  described  previously,  several 
experimental  techniques  were  used  for  determining  the  subcritical  response 
characteristics.  In  general,  the  most  useful  results  were  from  the  forced 
response  Co-Quad  technique.  Representative  measurements  of  the  in-phase  and 
out-of-phase  components  of  the  wing  acceleration  78.3  aileron  command 

displacement  ^ as  a function  of  frequency  are  shown  in  figure  23.  These 
results  are  approximately  6 percent  in  velocity  below  the  measured  open-loop 
flutter  point.  The  curves  to  the  left  on  this  figure  are  the  frequency 
response  of  the  open-loop  system;  the  curves  to  the  right  represent  the  closed- 
loop  response.  The  effectiveness  of  the  FMC  in  reducing  the  forced  response 
of  the  system  is  readily  apparent  by  comparing  the  resonant  response  peaks  of 
the  open-  and  closed-loop  systems. 

The  randomdec  technique  worked  best  as  the  flutter  speed  was  closely 
approached  and  the  damping  in  the  flutter  mode  became  very  small.  It  was 
especially  useful  here  since  it  was  considered  hazardous  to  apply  external 
excitation.,  A typical  response  time  history  trace  for  the  right  wing  accel- 
erometer 47. 8 > associated  randomdec  signature,  taken  approxi- 

mately 3 percent  in  velocity  below  the  flutter  point,  is  shown  in  figure  24. 

A comparison  of  calculated  and  measured  flutter  mode  damping  versus  air- 
speed for  the  model  is  presented  in  figure  25.  The  measured  values  were 
obtained  from  the  forced  response  technique  while  the  calculated  values  were 
obtained  from  the  characteristic  roots  of  the  equations  of  motion.  The  compar- 
ison shows  the  analysis  to  be  conservative  by  about  10  percent  in  predicting  the 
open-loop  flutter  velocity.  This  difference  may  be  attributed  in  part  to  the 
fact  that  the  measured  structural  damping  of  the  model  was  somewhat  higher  than 
the  damping  used  in  the  flutter  analysis.  Both  experimental  and  analytical 
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results  show  that  the  FMG  system  provides  a substantial  increase  in  damping 
near  the  open-loop  flutter  velocity.  The  measured  closed-loop  data  show  the 
system  to  be  less  effective  than  analytically  predicted.  This  difference  is 
believed  to  be  due  to  hystersis  in  the  outboard  aileron  actuator  system  com- 
bined with  a reduced  effectiveness  of  the  control  surfaces  that  were  not 
accounted  for  in  the  analysis.  The  maximum  velocity  tested  with  the  closed- 
loop  system  was  48.3  m/sec  (158  ft/ see);  however,  no  damping  values  were 
measured  above  47.2  m/sec  (155  ft/sec)  (indicated  by  a dashed  line  in  fig.  25) . 

A comparison  of  measured  flutter  mode  damping  versus  airspeed  for  the 
model  and  full-scale  airplane  is  shown  in  figure  26  in  terms  of  airplane 
velocity.  The  airplane  damping  values  were  obtained  from  transient  response 
records.  As  indicated  in  this  figure  the  model  open-loop  flutter  speed  is 
about  7.9  percent  higher  than  the  airplane  flutter  speed.  This  difference  is 
attributed  to  minor  variations  in  model  mass  and  stiffness  from  the  required 
values  combined  with  some  cable-mount  effects  on  the  rigid  body  dynamics  of 
the  model.  The  caleulated  airplane  flutter  speed  was  about  8.3  percent  below 
the  measured  point.  Thus  a consistency  does  exist  between  measured  and  calcu- 
lated flutter  velocities  for  both  the  model  and  airplane  in  that  the  analysis 
was  conservative  in  both  cases  by  about  the  same  amount.  The  data  in  figure  26 
show  that  the  model  and  airplane  have  the  same  closed-loop  damping  trends.  In 
both  cases  the  closed-loop  system  significantly  increases  the  damping  near  the 
open-loop  flutter  velocity.  Although  some  differences  in  damping  level  do 
exist,  it  is  felt  that  the  correlation  between  model  and  airplane  is  quite 
reasonable.  As  indicated  in  the  figure,  both  the  model  and  airplane  were 
tested  above  the  open-loop  flutter  velocity. 

RQC  system.-  The  objectives  of  the  RQC  studies  were  to  demonstrate  the 
effectiveness  of  a ride  control  system  in  reducing  the  acceleration  at  the 
pilot ^s  station  and  to  obtain  data  for  correlation  with  analysis  and  full- 
scale  flight.  During  the  RQC  studies  the  open-loop  (RQC  off)  and  closed-loop 
(RQC  on)  response  of  the  model  to  external  excitation  was  measured.  The  first 
series  of  tests  that  were  performed  involved  measuring  the  response  of  the 
model  to  a sinusoidal  gust  field  generated  by  the  oscillating  vanes.  The  fre- 
quencies of  the  primary  modes  of  interest  were  at  2,  13,  and  17.5  Hz.  Sample 
results  obtained  from  the  in-phase  and  out-of-phase  components  of  the  pilot 
station  acceleration  Z^ose  ^ function  of  vane  frequency  are  presented  in 
figure  27.  The  curves  to  the  left  are  the  open-loop  response;  the  curves  to 
the  right,  the  closed-loop  response.  Attenuation  of  the  closed-loop  response 
around  2 Hz  is  apparent.  However,  the  response  in  the  IS-'Hz  mode  is  so  low 
that  the  effect  of  the  ride  control  system  is  not  obvious.  These  results  for 
the  higher  modes  are  due  to  the  fact  that  the  effectiveness  of  the  oscillating 
vanes  in  generating  the  gust  field  falls  off  rapidly  at  the  higher  values  of 
frequency  (see  fig,  20) . The  canard  surfaces  were  used  to  generate  the  excita- 
tion for  the  higher  modes.  Results  at  the  same  test  condition  obtained  from 
a canard  frequency  sweep  are  shown  in  figure  28.  The  canard  amplitude  was  2°. 
The  data  are  presented  for  both  the  open-  and  closed-loop  system  in  terms  of 
the  ratio  of  pilot  station  acceleration  ^xiose  canard  command  signal  6^  ^ 

as  a fiinction  of  canard  frequency.  The  effect  of  the  RQC  system  on  the  higher 
modes  is  now  evident.  It  appears  that  some  combination  of  testing  techniques 
is  required  to  accurately  define  the  system  response  curves. 
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C-5A  ALDCS  MODEL  STUDY 


General 

In  an  effort  to  reduce  wing  fatigue  damage  and  thereby  prolong  the  service 
life  of  the  C~5A  fleet*  the  Air  Force  has  contracted  with  the  Lockheed-Georgla 
Company  to  develop  and  flight  test  a C-5A  airplane  with  an  active  lift  distri- 
bution control  system  (ALDCS) . This  system  is  designed  to  reduce  the  incre- 
mental inboard-wing  stresses  experienced  during  gusts  and  flight  maneuvers. 

The  ALDCS  uses  existing  controls  on  the  airplane  - ailerons  to  unload  the 
wing  tips  and  elevators  to  keep  the  airplane  in  trim.  Specific  design  goals 
for  the  ALDCS  are  to  reduce  the  symmetric  flight  incremental  wing  root  bending 
moment  by  at  least  30  percent  while  limiting  any  increase  in  torsional  moment 
to  less  than  5 percent.  A detailed  description  of  the  airplane  ALDCS  is  pre- 
sented in  reference  20. 

A wind-tunnel  study  of  a dynamically  scaled  aeroelastic  model  equipped 
with  the  proposed  ALDCS  was  undertaken  for  the  following  objectives:  (1)  to 

determine  the  ALDCS  effectiveness;  (2)  to  investigate  the  adverse  coupling  of 
structural  modes  due  to  the  ALDCS,  particularly  wing  flutter;  and  (3)  to 
obtain  experimental  data  for  correlation  with  analysis  and  to  guide  flight 
tests.  A photograph  of  the  1 /22-size  model  used  in  the  study  is  presented  in 
figure  29.  The  model  program  was  a joint  effort  of  the  Air  Force,  the  Lockheed- 
Georgia  Company,  and  the  Langley  Research  Center.  The  model  study  was  per- 
formed concurrently  with  the  development  of  the  airplane  ALDCS  and  was  com- 
pleted within  a 9-month  period  prior  to  the  beginning  of  airplane  flight  tests. 
Basically,  the  model  program  involved  the  modification  of  an  existing  1/22-size 
flutter  model  to  match  Froude  number  scaling,  the  incorporation  of  the  ALDCS 
in  the  model,  and  wind-tunnel  tests  in  the  transonic  dynamics  tunnel. 

Some  unique  features  of  the  C-5A  model  study  were  that  it  was  the  first 
scaled  model  study  of  a lift  distribution  control  system,  and  the  model  had 
an  onboard  hydraulic  system.  This  hydraulic  system  included  pump,  fluid 
cooling  system,  and  servovalves  that  powered  the  control  surface  actuators. 

The  weight  of  this  system  (about  16.3  kg  or  36  lb)  was  absorbed  as  onboard 
cargo  in  the  fuselage.  The  C-5A  model  study  required  the  application  of  many 
specially  developed  wind-tunnel  systems  and  model  technologies  such  as  (1)  the 
two-cable  suspension  system  for  minimum  restraint  to  permit  the  model  to  be 
essentially  free-flying,  reference  16;  (2)  although  not  used,  a special  roll 
control  system  was  available  which  altered  the  mount  system  cable  angles  in 
case  the  aileron  deflections  needed  to  keep  the  model  in  roll  trim  because 
excessive,  reference  21;  (3)  a lift-simulation  (cable-pneumatic  spring)  device 
that  provided  the  capability  of  varying  the  model  lift  coefficient  for  given 
test  conditions,  reference  22;  (4)  an  oscillating  vane  system  which  generated 
sinusoidal  gusts,  reference  17;  and  (5)  aileron  actuators  on  the  model  wing 
which  were  basically  duplicates  of  those  developed  for  the  delta-wing  flutter 
suppression  model  previously  described. 
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Model 


Scaling.-  Although  a 1/22-size  flutter  model  of  the  complete  C-5A  airplane 
was  available  from  earlier  flutter  clearance  studies  in  the  transonic  dynamics 
tunnel^  the  decision  was  made  to  rescale  and  modify  the  model  to  match  the 
airplane  Froude  number.  This  allowed  a closer  simulation  of  the  aerodynamic 
loading  and  dynamic  characteristics  of  the  airplane,  thus,  a better  evaluation 
of  the  ALDCS  could  be  made.  For  a Froude  number  scaled  model,  the  mass  ratio 
and  reduced  wavelength  are  also  matched  at  the  selected  design  test  conditions. 
The  model  scaling  factors  were  derived  so  that  Froude  number  was  matched  for 
the  model  at  a Mach  number  of  0.263  and  a dynamic  pressure  2.394  kN/m^ 

(50  lb/ft2)  in  the  wind  tunnel  with  freon  as  the  test  medium.  The  correspond- 
ing airplane  flight  conditions  were  a Mach  number  of  0.58  and  a dynamic  pres- 
sure of  19.87  kN/m^  (415  Ib/ft^)  which  corresponded  to  an  altitude  of  1524  m 
(5000  ft) . It  was  assumed  that  at  these  relatively  low  subsonic  Mach  numbers 
the  compressibility  effects  were  not  important  and  that  there  would  not  be  any 
significant  differences  between  the  aerodynamic  characteristics  of  the  model 
and  the  airplane. 

Design  and  construction.-  The  C-5A  ALDCS  model  was  designed  to  scale  two 
airplane  configurations,  wing  fuel  loadings  of  0 ^and  33  percent  with  approxi- 
mately  113  400  kg  (250  000  lb)  of  cargo  for  both  cases.  The  1/22-size  model 
had  a wing  span  of  3.037  m (9.96  ft).  The  0-percent  fuel  configuration  weighed 
65.1  kg  (143.5  lb),  and  the  33-percent  fuel  configuration  weighed  77. 2 kg 
(170.2  lb).  To  minimize  costs,  components  of  an  existing  flutter  model  were 
used  as  much  as  possible  in  the  ALDCS  model.  A spar  and  pod  type  of  construc- 
tion was  used.  Some  of  the  construction  details  are  shown  in  figures  30  and  31 
The  metal  spars  carried  the  structural  loads  and  simulated  the  stiffness 
characteristics.  The  balsa  wood  pods  duplicated  the  aerodynamic  shape  and 
were  ballasted  (with  the  spars)  to  simulate  the  mass  characteristics.  The 
ALDCS  model  required  close  simulation  of  the  wing  properties.  Therefore,  new 
wing  spars,  engine-pylon  spars,  and  fuselage  spars  were  constructed.  (The 
fuselage  signficantly  affected  the  wing  dynamics.)  Some  new  wing  and  fuselage 
pods  were  also  constructed.  The  existing  flutter  model  empennage  was  used  in 
the  ALDCS  model;  consequently,  the  empennage  stiffness  was  not  properly  scaled. 
In  reworking  the  empennage  to  incorporate  the  horizontal  tail  active  control 
mechanism,  an  attempt  was  made  to  simulate  the  required  sealed  mass  properties 
of  the  overall  empennage;  however,  the  final  empennage  was  considerably  under 
weight.  The  ailerons  were  scaled  and  eonsisted  of  a metal  spar  covered  with 
balsa  wood  which  was  faired  to  give  the  proper  scaled  aerodynamic  shape.  The 
aileron-wing  gap  was  not  sealed  on  the  model,  although  the  gap  was  kept  as 
small  as  practical. 

With  the  exception  of  the  empennage,  the  model  simulated  the  mass  and 
stiffness  of  the  airplane  quite  well,  including  the  important  wing  structural 
mode  frequencies  and  mode  shapes . It  was  concluded  that  the  model  adequately 
represented  the  airplane  for  the  purposes  of  the  ALDCS  study. 

Control  systems.-  The  aerodynamic  surfaces  used  for  active  controls  on 
the  C-5A  airplane  consisted  of  the  ailerons  and  the  elevators.  However,  for 
practical  model  design  considerations,  the  all-movable  horizontal  tail  was  used 


to  provide  active  pitch  control  instead  of  the  elevators.  An  appropriate  com- 
pensation was  made  in  the  control  law  to  account  for  this  difference. 

All  active  control  surfaces  on  the  model  were  actuated  by  an  onboard 
hydraulic  system.  The  aileron  actuators  were  of  the  same  design  as  those 
used  for  the  delta-wing  research  model  described  earlier.  The  aileron  also 
could  be  remotely  controlled  (by  the  model  pilot)  to  permit  static  roll  trim 
control.  The  tail  actuator  controlled  the  dynamic  pitch  angle  of  the  complete 
horizontal  stabilizer  and  was  simply  a hydraulically  actuated  piston  (see 
fig.  30) . The  piston  housing  was  mechanically  coupled  to  an  electric  motor 
drive  system  (also  controlled  by  the  pilot)  which  could  move  the  complete 
piston  unit  and  thus  vary  the  tail  static  pitch  angle  for  model  pitch  trim. 

The  piston  drove  the  tail  dynamically  and  worked  against  two  coil  springs  which 
attempted  to  keep  the  piston  in  a centered  position.  In  the  event  of  a hydrau- 
lic failure,  the  centering  springs  would  keep  the  horizontal  stabilizer  at  its 
static  trim  setting,  whereas  the  ailerons  would  tend  to  become  free-floating 
and  self -alining  with  the  wing  count our. 

The  power  for  the  hydraulic  system  was  provided  by  an  onboard  hydraulic 
pump  (see  fig.  31).  This  pump  was  an  aircraft  system  that  was  adapted  to  the 
model  and  had  an  output  pressure  of  11.3  x 10^  kN/m^  (1600  Ib/in^) • For 
lengthy  operation  of  the  hydraulic  system,  it  was  necessary  to  cool  the  hydrau- 
lic fluid,  and  a water  cooling  jacket  was  provided  onboard  the  model.  The 
water  was  externally  pumped  to  the  jacket  through  flexible  plastic  hoses  which 
were  secured  to  the  ins trumentation  umbilical  cord. 

Servovalves  were  used  to  control  the  hydraulic  pressure  supplied  to  the 
control  surface  actuators . These  valves  were  of  the  same  type  as  those  used 
for  the  delta-wing  model.  The  model  actuation  system  was  compensated  by 
electronic  circuitry  to  give  frequency  response  characteristics  that  closely 
matched  the  transfer  functions  of  the  airplane  actuators. 

Instrumentation . - Bending  and  torsional  moments  on  the  model  were  measured 
by  using  resistance-wire  strain  gages  mounted  at  several  spanwise  stations  on 
the  wings  and  at  the  roots  of  the  vertical  and  horizontal  tail  surfaces. 

Aileron  hinge  moments  were  measured  by  using  strain  gages  mounted  on  each 
aileron  pivot  arm.  Vertical  acceleration  on  each  wing  near  the  aileron  and  at 
the  fuselage  center  of  gravity  was  measured  by  using  accelerometers.  Fuselage 
angle  of  attack  was  measured  by  using  a servoaccelerometer.  The  angular  posi- 
tion of  each  control  surface  was  measured  by  using  potentiometers.  Fuselage 
center-of-gravity  pitch  rate  was  measured  by  using  a pitch  rate  gyro.  Tension 
in  the  model  support  cables  was  measured  by  using  load  cells. 


Control  Law 

A simplified  diagram  of  the  active  control  systems  used  in  the  C-5A  ALDCS 
model  is  presented  in  figure  32.  There  were  two  active  control  systems  operat- 
ing on  the  model,  the  basic  aircraft  pitch  stability  autmentation  system 
(pitch  SAS)  and  the  ALDCS.  Both  commanded  symmetric  actuation  of  the  control 
surfaces.  The  pitch  SAS  employed  a feedback  from  the  pitch  rate  gyro  at  the 
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fuselage  center  of  gravity  to  actuate  the  horizontal  tail.  The  ALDCS  employed 
feedbacks  from  both  the  pitch  rate  gyro  and  the  fuselage  center-of -gravity 
accelerometer  to  actuate  the  horizontal  tail  and  feedbaeks  from  the  wing  tip 
accelerometers  to  actuate  the  ailerons.  Note  that  the  acceleration  signals 
from  the  two  wings  were  summed  in  order  to  filter  out  unsymmetrical  motions. 

The  capability  of  supplying  external  command  signals  to  the  control  surfaces 
was  included.  The  gains  ^^STAB’  ^AIL»  ^SAS  scheduled  signal  gains 

manually  set  according  to  a predetermined  Mach  number  dynamic  pressure  schedule. 


Tests  and  Procedure 

A summary  of  the  C-5A  ALDCS  model  test  configuration  and  test  parameters 
is  presented  in  figure  33.  The  33-percent  wing  fuel  configuration  was  tested 
first  because  this  was  a more  realistic  flight  condition,  and,  hence,  consider- 
ably more  data  were  obtained  with  this  configuration.  The  0-percent  fuel  con- 
figuration, after  a brief  ALDCS  effectiveness  check,  was  extensively  investi- 
gated to  determine  the  ALDCS  effect  on  flutter  because  this  wing  configuration 
had  the  lowest  flutter  speed  (ALDCS  off) . 

Model  support  and  test  techniques.-  The  free-flying  mount  system  used  for 
the  C-5A  model  was  essentially  the  same  as  that  previously  described  for  the 
B-52  model  with  the  exception  that  the  pulleys  were  mounted  in  the  model 
fuselage  rather  than  on  the  tunnel  wall.  The  model  was  restrained  by  using 
the  snubber  cables  during  the  flutter  tests  at  Mach  numbers  above  about  0.7 
because  the  model  was  unstable  in  a Dutch  roll  type  mode.  During  the  dynamic 
load  tests,  the  model  was  not  only  snubbed  but  was  also  tied  down  by  cables 
attached  to  the  nose  and  rear  of  the  fuselage. 

In  the  static  aerodynamic  studies,  the  simulated  lift  device  shown  in 
figure  34  was  employed.  Briefly,  this  device  consisted  of  a single  cable 
attached  to  the  fuselage  at  the  model  center  of  gravity  which  would  exert  a 
down  force  to  the  model  as  needed.  This  was  accomplished  by  attaching  the 
cable  to  a piston  essentially  floating  in  an  air  cylinder  which  was  located  in 
the  plenum  outside  of  the  test  section.  By  varying  the  air  pressure  on  the  top 
side  of  the  piston,  a down  load  could  be  transmitted  to  the  model.  In  opera- 
tion, as  the  model  angle  of  attack  was  varied,  the  air  pressure  to  the  cylinder 
was  adjusted  to  compensate  for  the  additional  model  lift  and  to  maintain  the 
model  at  its  normal  flying  position  near  the  center  of  the  tunnel.  By  measuring 
the  tension  in  the  cable,  the  additional  lift  on  the  model  could  be  measured. 

Aileron  and  stabilizer  frequency  sweeps  were  extensively  employed  in  the 
dynamics  tests.  In  these  sweeps,  an  external  sinusoidal  electrical  signal 
was  supplied  to  the  control  system  to  actuate  symmetrically  the  control  surfaces 
and  generate  aerodynamic  forces.  The  model  response  to  these  aerodynamic 
excitation  forces  was  measured.  The  frequency  sweeps  ranged  from  about  0.5  to 
20  Hz.  Several  control  surface  amplitudes  were  used.  S^nnmetric  aileron  and 
stabilizer  step/ramp  functions  were  also  employed  to  excite  the  model.  Part  of 
the  ALDCS  ef feetiveness  studies  involved  use  of  sinusoidal  gusts  generated  by 
the  tunnel  oscillating  vane  system.  Both  symmetric  and  antisymmetric  gusts  were 
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used  in  the  tests.  The  gust  vane  frequency  was  varied  from  0.7  to  16  Hz.  In 
order  to  reduce  the  static  bending  moments,  a large  portion  of  the  tests  were 
performed  with  the  ailerons  set  at  a nominal  angle  of  +5"^  trailing-edge  up 
(called  uprig  angle) . 

Static  aerodynamic  measurements.-  With  the  model  free-f lying  and  the  lift- 
simulation-device  cable  attached,  static  aerodynamic  data  were  measured  at 
dynamic  pressures  of  1.92  and  2.39  kN/m^  (40  and  50  Ib/ft^).  For  each  of  the 
three  aileron  uprig  angles  of  0°,  +10°,  and  -10°,  the  model  was  varied  through 
the  angle-of-at tack  range  about  the  normal  flying  attitude.  The  added  lift  was 
compensated  for  by  adjusting  the  down  force  in  the  lift  cable.  Thus,  static 
aerodynamic  data,  such  as  model  and  Cig,  and  the  effect  of  the  aileron 
on  the  wing  lift  distribution  could  be  derived. 

Dynamic  load  measurements.-  The  purpose  of  these  tests  was  to  determine 
the  dynamic  wing  and  empennage  loads  produced  by  oscillating  the  ailerons  and 
stabilizer.  Data  were  obtained  for  aileron  and  stabilizer  frequency  sweeps  at 
various  amplitudes.  During  these  tests  the  model  was  restrained  by  the  snubber 
cables  and  tie-down  cables  at  the  nose  and  rear  of  the  fuselage.  This  fuselage 
restraint  was  used  in  an  effort  to  structurally  uncouple  the  wing  and  empennage 
approximating  a cantilever  root  condition  sp  that  the  experimental  data  could 
be  correlated  with  analysis  where  the  wing  and  empennage  were  treated  independ- 
ently as  cantilevered  structures. 

ALDCS  effectiveness  tests.-  The  ALDCS  effectiveness  tests  were  made  with 
the  model  free-flying  and  a nominal  aileron  uprig  of  +5°.  The  effectiveness 
of  the  ALDCS  in  reducing  wing  loads  was  examined  for  a variety  of  test  variables 
as  shown  in  figure  33.  An  earlier  version  of  the  control  law,  identified  by 
analysis  as  destabilizing  a higher  structural  mode,  was  also  tested. 

i 

Flutter  tests.-  The  test  procedure  was  to  vary  Mach  number  M and  dynamic 
pressure  q along  an  essentially  constant  total  pressure  line  with  the  model 
ALDCS  off.  At  discrete  points  along  each  constant  pressure  path,  the  model 
response  to  an  aileron  step  was  measured.  The  aileron  step  was  repeated  with 
the  ALDCS  on.  These  M-q  sweeps  were  initiated  at  a low  density  level  in  the 
tunnel,  and  the  sweeps  repeated  at  higher  density  levels  until  the  envelope  was 
cleared  or  flutter  was  obtained.  Because  of  a model  Dutch  roll  type  of 
instability  on  the  cable  mount,  it  was  necessary  to  conduct  a portion  of  the 
flutter  tests  with  the  model  snubbed. 


Results 

The  major  objectives  of  the  C-5A  ALDCS  model  study  were  successfully 
accomplished.  The  model  and  the  active  control  systems  appeared  reasonably 
representative  of  the  airplane,  and  the  model  ALDCS  achieved  its  design  goal 
in  reducing  wing  dynamic  bending  moment.  However,  because  the  model  suspension 
system  significantly  distorted  the  rigid  body  modes,  the  effect  of  the  ALDCS 
on  these  modes  was  not  determined.  The  ALDCS  effect  on  the  model  wing  flutter 
characteristics  appeared  to  be  negligible,  probably  because  the  wing  flutter 
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mode  was  antisymmetric,  whereas  the  ALDCS  was  desigiled  to  attenuate  s3mmietriG 
loads  only.  Some  typical  results  are  presented  in  figures  35  to  38. 

The  model  appeared  to  simulate  reasonably  well  the  overall  static  aero- 
dynamic characteristics  including  wing  load  distribution  of  the  airplane. 
However,  the  ailerons  were  not  as  effective  as  those  of  the  airplane'.  A given 
model  aileron  deflection  produced  less  (ranging  from  about  15  to  35  percent) 
of  a load  change  than  was  produced  on  the  airplane  for  the  same  deflection. 
Aileron  gains  of  1.6  times  nominal  were  therefore  included  in  the  test  param- 
eters. The  dynamic  effects  on  the  model  loads  due  to  the  control  surface 
oscillations  compared  favorably  with  analysis. 

The  ALDCS  effectiveness  was  established  best  by  the  aileron  frequency 
sweeps.  The  aileron  sweeps  excited  higher  frequency  modes  better  than^'either 
the  stabilizer  sweeps  or  the  sinusoidal  gust  sweeps.  At  the  present  time,  the 
step/ramp  response  data  have  not  been  reduced  sufficiently  to  determine  their 
quality.  The  response  of  the  model  wing  to  a typical  aileron  sweep  at  the 
scaled  flight  condition  is  shown  in  figure  35.  For  these  sweeps,  the  model 
scaled  the  33-percent  wing  fuel  configuration,  the  aileron  amplitude  was  set 
for  ±5°,  the  ALDCS  was  at  nominal  aileron  gain,  and  the  pitch  SAS  w^s  on.  The 
normalized  wing  bending  moment  at  the  wing  root  station  is  shown  on  the  left 
plot;  the  normalized  wing  torsional  moment  is  shown  on  the  right.  The  fre- 
quency of  the  wing  first  bending  mode  was  about  4 Hz.  Another  mode  which  con- 
tributed significantly  to  the  model  response  had  a frequency  of  about  11  Hz. 

It  can  be  seen  that  the  major  effect  of  the  ALDCS  is  to  reduce  the  bending 
moments  by  about  50  percent  at  the  4-Hz  mode;  the  torsional  moments  were  also 
reduced  by  the  ALDCS.  The  distribution  of  the  bending  and  torsional  moments 
along  the  wing  span  is  shown  for  the  same  conditions  in  figures  36  and  37.  In 
figure  36  the  bending  moments  pertain  to  the  4-Hz  mode.  The  torsional  moment 
in  figure  37  is  for  the  11-Hz  mode  where  the  torsional  moments  are  greatest. 

It  can  be  seen  that  the  load  reduction  experienced  at  the  root  is  obtained  in 
nearly  the  same  proportion  over  the  entire  span. 

In  the  flutter  tests,  the  33~percent  wing  fuel  configuration  did  not 
flutter  within  the  scaled  flight  envelope.  The  0-percent  fuel  configuration 
experienced  antisymmetric  wing  flutter  at  the  two  points  shown  in  figure  38. 
The  data  in  this  figure  are  presented  in  the  form  of  airplane  equivalent  air- 
speed. In  each  instance,  the  ALDCS  had  no  effect  on  the  flutter.  The  model 
flutter  occurred  at  a frequency  of  about  13  Hz  and  appeared  to  consist  of  a 
combined  higher  wing  bending  and  torsional  mode  with  most  of  the  motion  on  the 
outboard  portion  of  the  wing.  A similar  type  of  wing  flutter  occurred  during 
earlier  flutter  model  tests. 


CONCLUDING  REM.A.EKS 


In  this  paper  the  experiences  to  date  in  testing  aeroelastic  models 
equipped  with  active  controls  in  the  Langley  Research  Center  transonic  dynamics 
tunnel  have  been  described.  Such  items  as  model  design,  construction,  and  test 
techniques  have  been  described  in  discussing  three  model  experimental  programs. 
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Also,  some  typical  data  results  have  been  presented.  The  three  model  studies 
were  a simple  delta-wing  flutter  suppression  model,  a 1/30-size  dynamically 
scaled  aeroelastic  model  of  the  B-52  CCV,  and  a l/22-size  dynamically  scaled 
aeroelastic  model  of  the  G-5A  aircraft.  The  delta-wing  model  was  used  to 
evaluate  the  aerodynamic  energy  concept  of  flutter  suppression.  The  B-52  model 
was  equipped  with  flutter  mode  control  and  ride  quality  control  systems,  while 
the  G-5A  model  was  equipped  with  a lift  distribution  control  system.  In  all 
three  studies  active  controls  were  successfully  implemented  on  the  models.  The 
delta-wing  flutter  suppression  system  did  provide  an  increase  in  flutter  dynamic 
pressure,  and  the  experimental  results  are  in  reasonable  agreement  with  analyt- 
ical trends.  Both  B-52  model  systems  provided  improved  performance,  and  the 
FMG  experimental  results  compare  favorably  with  analytical  and  flight  data. 

The  G-5A  ALDGS  did  provide  a significant  reduction  in  incremental  dynamic  bend- 
ing moment  on  the  wing  with  no  apparent  effect  on  the  flutter  characteristics. 

Experiences  with  these  models  have  indicated  that  the  addition  of  active 
controlled  aerodynamic  surfaces  has,  indeed,  added  complexity  to  aeroelastic 
modeling  technology.  However,  no  insurmountable  obstacles  have  been  encountered 
in  these  three  studies,  and  the  success  to  date  indicates  that  much  useful 
information  can  be  obtained  from  model  test  results. 
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Figure  l.~  Delta-wing  model  mounted  in  transonic  dynamics  wind  tunnel. 
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Figure  4.-  Delta-wing  model  control  laws. 
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Figure  6.“  Simplified  block  diagram  of  delta-wing  flutter  suppression  system. 
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Figure  7.-  Delta-wing  trailing-edge  control  actuation  system 
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Figure  8.-  Effects  of  control  surface  and  accelerometer  locations  on  flutter  dynamic  pressure. 
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Figure  9.-  Basic  randomdec  concepts 
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igure  11.-  Effect  of  different  control  laws  on  flutter  dynamic  pressure  at 


Figure  13.-  Measured  and  calculated  variation  of  flutter  velocity  index  parameter  with  Mach 
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Figure  15.  B-52  model  mounted  in  transonic  d3mamics  tunnel 


Figure  16 •-  B-52  model  control  surface  and  sensor  locations. 
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Figure  17.-  B-52  model  scaling  parameters. 
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Figure  18.-  Exposed  view  of  B-52  model 
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Figure  19.-  View  of  B-52  model  showing  gust  generating  vanes 
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oscillating  vane  angle  of  6®  and  a velocity  of  35.4  m/sec. 
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Figure  21.-  Simplified  block  diagram  of  B-52  model  FMC  system. 


Figure  22.-  Simplified  block  diagram  of  B-52  model  RQC  system. 
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CALCULATIONS  MEASUREMENTS 

EMC  OFF  • FMC  OFF 

FMC  ON  ■ FMC  ON 
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Figure  25.-  Comparison  of  measured  and  calculated  damping  for  the  B-52  model 
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Figure  26.-  Comparison  of  B-52  CCV  model  and  airplane  damping  characteristics  of  the 

flutter  mode. 
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Figure  27. ~ Measured  frequency  response  of  B-52  model  to  oscillating  gust  vane  excitation  for 

a vane  angle  of  6®  and  a velocity  of  33.7  m/sec. 
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Figure  28. - Measured  frequency  response  of  B-52  model  to  canard  excitation  at  a velocity 

of  33.7  m/sec. 
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Figure  32.-  Simplified  block  diagram  of  C-5A  active  lift  distribution  control  system  (ALDCS) . 
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Figure  33.-  C-5A  ALDCS  model  test  summary. 
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Figure  36.-  Spanwise  distribution  of  C-5A  model  normalized  dynamic  wing  bending  moment  at 

frequency  of  4 Hz. 
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Figure  38.-  Effect  of  ALDCS  on  C-5A  model  wing  flutter. 


A REMOTELY  AUGMENTED  APPROACH  TO  FLIGHT  TESTING 
OF  ADVANCED  CONTROL  TECHNOLOGY 

Herman  A . Rediess,  Eldon  E.  Kordes  , and  John  W.  Edwards 
NASA  Flight  Research  Center 

ABSTRACT 


A new  technique  for  flight  testing  advanced  control  system  concepts  has  been 
developed  at  the  NASA  Flight  Research  Center  as  an  outgrowth  of  the  remotely 
piloted  research  vehicle  (RPRV)  program . The  control  laws  are  implemented 
through  up-down  data  links  and  a general-purpose  ground  based  digital  computer 
that  provides  the  control  law  computations . The  advantages  of  this  remotely  aug- 
mented approach  over  onboard  systems  are:  reduced  hardware  development  time 
and  cost;  ease  of  computer  programing  and  verification;  and  increased  flexibility 
for  changing  control  laws  . This  paper  describes  the  techniques  , discusses  selected 
flight-test  results  of  a large-scale  F- 15  RPRV  program,  and  presents  plans  for 
applying  the  technique  to  future  RPRV  and  manned  aircraft  programs . 
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DEVELOPMENT  OF  METHODS  FOR  THE  ANALYSIS  AND 


EVALUATION  OF  CCV  AIRCRAFT 


Robert  C . Schw.anz 
Air  Force  Flight  Dynamics  Laboratory 


ABSTRACT 


The  development  of  an  advanced,  computerized  method  for  the  analysis  and 
evaluation  of  the  aeroelastic  stability  and  control  parameters  of  controls- 
fixed  and  controls-f ree  flight  vehicles  Is  presented.  Specifically,  the  con- 
tractually developed  Level  2.01  FLEXSTAB  Computer  Program  System  is  described. 
Technical  areas  in  aerodynamics,  dynamics,  and  control  system  synthesis  are 
defined  in  which  further  research  and  development  are  planned  to  extend  the 
analysis  capability  of  the  System  for  future  CCV  applications. 


INTRODUCTION 


The  development  of  computer  programs  to  analyze  and  evaluate  the  aero- 
elastic characteristics  of  controls-fixed  aircraft  has  intensified  In  past 
years.  This  Increase  in  Interest  has  been  due  to  the  design  and  construction 
of  large  transport  aircraft,  such  as  the  Boeing  7^7,  McDonnell  Douglas  DC- 10, 
and  Lockheed  L-1011,  and  of  the  high  performance  aircraft,  such  as  the  SST 
and  the  B-1.  Recent  articles  by  Stauffer,  Lewalt,  and  Hobllt  (Reference  1) 
and  Rowan  and  Burns  (Reference  2)  describe  methods  and  capabilities  currently 
available  within  the  industry.  This  paper  describes  the  Level  2.01  FLEXSTAB 
Computer  Program  System  (Reference  3)  that  has  been  developed  by  the  Control 
Criteria  Branch  for  the  aeroelastic  stability  and  control  analyses  of  both 
controls-fixed  and  controls-f ree  ml  1 i tary  ai rcraft.  This  development  Included 
careful  consideration  of  the  applicability  of  the  method  to  military  mission 
objectives,  the  variety  of  potential  military  users  of  the  method,  the  man- 
power and  conputer  costs  Involved  in  using  the  method,  and  the  criteria  that 
govern  the  application  of  the  method.  This  development  has  taken  particular 
care  to  solve  some  of  the  problens  that  are  unique  to  the  analysis  and  evalu- 
ation of  Control  Configured  Vehicle  (CCV)  aircraft  operating  at  reduced 
frequencies  that  are  small. 

As  noted,  there  are  mission  and  user  requirements  placed  upon  any  CCV- 
type  aircraft  analysis  and  evaluation  method  developed  for  the  USAF.  The 
mission  objectives  of  these  aircraft  impose  severe  and  complex  requirements, 
requiring  that  the  method  analyze: 
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The  subsonic,  transonic,  supersonic,  and  hypersonic  speed  regimes. 

The  complex,  three-dimensional,  aerodynamic  interference  flow 
fields  of  transport,  bomber,  and  fighter  aircraft. 

The  structural  dynamics  of  both  low  and  the  high  structural  aspect 
ratio  lifting  surfaces  of  aircraft. 

The  static  and  dynamic  stability  of  aircraft  with  both  unusual 
inertial  distributions  and  large  translational  and  rotational 
rates  of  motion. 

An  examination  of  the  major  research  and  development  organizations 
within  the  Air  Force  Flight  Dynamics  Laboratory  (AFFDL)  and  the  Aeronautical 
Systems  Division  at  Wri ght-Patterson  AFB  indicates  that  there  are  three  types 
of  users  who  impose  additional  requirements: 

Those  concerned  with  conceptual  design  and  development  only.  These 
users  desire  a fast,  inexpensive,  and  proven  method  that  performs 
reliable  design  and  evaluation  of  new  and  innovative  aircraft. 

Those  concerned  with  the  responsibilities  of  following  and  monitor- 
ing the  development  of  a new  aircraft  by  the  contractors,  from 
the  conceptual  design  to  the  flight  test  phases.  Again  versatil- 
ity and  cost/effectiveness  are  imperative  due  to  the  limited 
manpower  that  is  available. 

Those  concerned  wi th  developing  new  and  advanced  technologies  for 
future  applications.  These  users  desire  a wel  1 documented  and 
versatile  method  that  can  be  easily  modified  to  prove  their  ideas 
before  major  computer  program  development  is  initiated. 

As  noted,  each  of  these  users  has  a unique  problem  that  the  method  must 
address.  Fortunately,  these  user  requirements  for  high  speed,  low  cost,  and 
versatility  are  compatible  and  can  be  met  using  the  large  digital  computer 
and  aerodynamic  and  structural  finite  element  theory. 

The  development  of  an  analysis  method  to  meet  these  requirements  was 
begun  in  197i  by  the  Control  Criteria  Branch  of  AFFDL.  A 1973“197^  target 
date  was  set  for  the  completion  of  the  analysis  method  to  ensure  support 
for  the  development  of  the  Ride  Control  System  of  the  B-1  aircraft  and  the 
Reduced  Static  Stability  systems  proposed  for  several  Lightweight  Fighter 
aircraft  configurations.  At  that  time,  descriptions  of  the  existing  analysis 
methods  within  the  industry  were  meager  and  only  a limited  amount  of  financial 
resources  were  available  for  the  planned  contractual  work. 

An  obvious  technique  for  acquiring  a CCV  analysis  and  evaluation  method 
would  have  been  to  purchase  the  most  accurate  and  versatile,  contractor- 
developed,  design  method  available.  Discussions  with  the  aerospace  contractors 
indicated  that  their  existing  design  methods  in  flight  controls,  aerodynamics, 
structural  analysis,  and  dynamics  could  suffice  in  the  short  term.  However, 
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due  to  the  loose  and  often  undocumented  federation  of  computer  programs  used 
by  each  contractor,  the  AFFDL  Control  Criteria  Branch  would  have  had  to 
purchase  the  "expert"  who  developed  each  program  to  implement  this  technique. 
Thus,  it  was  impossible  to  make  a direct  purchase  to  satisfy  the  identified 
needs. 

The  search  was  then  diverted  to  the  newly  developing  controls-fixed 
aircraft  analysis  and  evaluation  methods  that  contained  the  necessary  mathe- 
matical sophistication.  The  prime  candidate  in  the  1971"1972  time  period 
was  the  Level  1.01  FLEXSTAB  Conputer  Program  System  bei ng  developed  by  the 
Boeing  Company,  Seattle,  Washington,  under  contract  to  the  NASA  Ames  Research 
Center  (Reference  4).  This  program  could  not  meet  the  USAF  requirements  in 
the  transonic  and  hypersonic  speed  regimes,  had  a limited  unsteady  aero- 
dynamics computational  capability,  had  no  turbulence  analysis  capability,  and 
had  a restricted  mathematical  representation  of  high  aspect  ratio  structures 
via  elastic  axes  and  lumped  masses.  However,  the  programs  were  well  documented, 
were  somewhat  modularized,  and  with  some  modifications  could  meet  the  majority 
of  the  requirements  of  the  USAF.  Of  considerable  benefit  was  the  fact  that 
NASA  had  already  spent  approximately  $500,000  developing  the  aerodynamic  and 
structural  modules  of  FLEXSTAB.  Thus,  with  limited  expenditures  by  the 
Control  Criteria  Branch,  the  modules  for  flight  control  systems  analysis 
could  be  added  to  meet  both  the  time  schedule  and  budget  objectives. 

The  development  plan  to  construct  the  control  system  analysis  modules 
was  formulated  and  coordinated  with  NASA  Ames  Research  Center  (ARC).  It  was 
decided  that  NASA/ARC  would  concentrate  their  immediate  resources  in  further 
checking  the  accuracy  of  the  aerodynamics  and  structures  modules  of  Level  1.01 
FLEXSTAB.  Meanwhile,  the  Control  Criteria  Branch  would  implement  Level  1.01 
at  Wri ght-Patterson  Air  Force  Base  (WPAFB)  to  measure  the  accuracy  and 
efficiency  of  the  programs  using  current  military  bomber,  transport,  and 
fighter  aircraft  as  test  cases,  in  addition,  the  AFFDL  would  begin  a con- 
tractual effort  to  develop  the  control  system  analysis  modules.  The  combina- 
tion of  these  aerodynamic,  structural,  and  control  system  analysis  modules 
would  then  form  the  basis  for  Level  2.01  FLEXSTAB  to  be  used  by  NASA  and 
USAF  In  the  stability  and  control  analysis  of  conventional  and  CCV-type  air- 
craft. 


The  Level  2.01  FLEXSTAB  Computer  Program  System  is  in  the  final  check-out 
phase.  The  contracted  work  Is  scheduled  for  completion  in  November,  1974. 

The  Control  Criteria  Branch  has  been  evaluating  a pre-release  version  of 
Level  2.01  since  February,  1974  with  the  primary  applications  being  made  to 
the  C-5A,  B-52E,  B-1,  and  F-111  TACT  aircraft.  An  oral  technical  presentation 
is  scheduled  for  October,  1974  at  the  AFFDL.  Several  papers  will  be  presented 
by  the  contractor  in  coming  technical  meetings  to  more  fully  describe  Level 
2.01  and  to  illustrate  its  application  to  the  B-52E  and  other  aircraft. 
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DESCRIPTION  OF  LEVEL  2.01  FLEXSTAB 


The  development  of  the  control  system  analysis  modules  and  the  inter- 
facing of  them  to  the  Level  1.01  aerodynamic  and  strutures  modules  has  been 
done  under  an  AFFDL  research  and  development  contract  with  the  Boeing  Company, 
Seattle,  Washington.  As  a first  step  in  the  contract,  the  principal  investi- 
gators established  firm  guidelines  to  meet  the  Statement  of  Work  from  the 
Control  Criteria  Branch.  Their  initial  report  (Reference  5)  on  the  contract 
summarized  these  guidelines: 

No  predetermination  of  "important  motion  parameters"  per  previous 
short  cuts  in  analysis.  The  equations  of  motion  should  not  be 
"tailored"  for  conventional  aircraft,  e.g.,  the  method  would  not 
neglect  the  forward  Speed  degree  of  freedom  of  the  "body-fixed" 
axis  system  as  currently  practiced  by  most  structural  dynamacists. 

The  initial  conditions  of  motion  to  be  as  general  as  possible. 

Only  the  initial  conditions  of  linear  and  angular  accelerations 
were  eliminated  because  of  theoretical  aerodynamic  problems. 

Reasonable  restriction  of  the  number  of  feedback  and  pilot  inputs 
and  of  the  order  of  the  control  system  filters. 

Hinge  moment  aerodynamic  effects  represented  as  an  option. 

Compatibi 1 i ty  wi th  the  Level  l.Oi  FLEXSTAB  program  to  take  advantage 
of  NASA  sponsored  improvements.  In  fact,  the  NASA  coding  require- 
ments for  the  Level  1.01  FLEXSTAB  were  specified  by  the  Control 
Criteria  Branch. 

No  higher  user  skill  level  than  the  capability  to  create  simple 
Fortran  statements  as  taught  to  Freshmen  engineering  students. 

Independence  from  the  specialized  math  models  of  actuators,  of 
control  surface/actuator  coupling,  and  of  turbulence  Power 
Spectral  Density  shapes. 

Capability  for  the  analysis  of  both  the  open  and  closed  loop  system 
responses  due  to  deterministic  gusts  and  due  to  random  turbulence. 

Input  data  formats  that  minimize  the  preparatory  work  requi  red  by 
the  user. 

Minimization  of  the  complexity  of  modules  within  each  program  to 
permit  the  user  to  understand  the  basic  calculations  by  the 
program. 

A program  structure  that  provides  for  a maximum  number  of  accurately 
determined  conplex  number  roots. 
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Computer  overlay  structure  that  minimize  the  computer  cycle  time 
In  production  runs. 

Above  all  else.  It  was  established  that  program  risks  must  be  Identified 
and  reported  before  the  initiation  of  any  detailed  engineering  and  coding. 
These  high  risk  areas  were  to  be  avoided  until  a program  existed  that  could 
numerically  demonstrate  the  analysis  and  the  evaluation  problems  In  these 
areas  and,  at  that  point,  USAF  or  NASA  funding  cxi  specific  high  risk/high 
payoff  areas  could  be  initiated.  The  test  case  specified  to  check  Level  2.01 
FLEXSTAB  Is  the  B -52  LAMS  (Reference  6)  at  Flight  Condition  1:  M = 0.569, 

Altitude  = 4,000  ft.  Weight  = 350»000  lbs.,  and  Center  of  Mass  = 0.298c. 


Physical  Structure  of  Level  2.01  FLEXSTAB 


As  mentioned,  the  Level  1.01  FLEXSTAB  programs  were  intended  for  the 
stability  and  control  analysis  of  controls-fixed  aircraft.  In  order  to 
inprove  the  efficiency  and  suitability  of  the  Level  2.01  Systems  for  both 
controis-f Ixed  and  controls-free  aircraft  analysis  and  In  order  to  meet  the 
stated  guidelines,  the  16  computer  pro grans  of  Level  1.01  (Figure  l)  were 
overlayed  and  restructured.  This  meant  modification  of  all  four  sections  of 
FLEXSTAB:  Airplane  Definition,  Airplane  StabI  1 1 ty  Evaluation,  Graphical 

Display,  and  Auxiliary  Program  sections.  The  net  result  In  Level  2.01 
FLEXSTAB  Is  13  computer  programs  (Figure  2)  that  are  Interconnected  by  cards 
and  magnetic  tapes. 

A more  detailed  description  of  the  physical  structure  of  the  Level  2.01 
FLEXSTAB  System  can  be  accomplished  by  contrasting  Level  2.01  programs  to 
those  of  Level  1.01.  Then,  current  government  and  Industrial  users  of 
Level  1.01  can  more  easily  visualize  Level  2.01  FLEXSTAB.  To  further  facili- 
tate this  contrast.  Level  2.01  programs  have  been  segmented  Into  the  sane 
four  analysis  sections  as  before  and  Individual  program  acronyms  of  Level 
1.01  are  maintained  wherever  possible.  Since  these  program  acronyms  have 
been  In  active  use  for  more  than  three  years.  It  is  hoped  roost  readers  will 
have  some  familiarity  with  the  terminology  of  Level  2.01  FLEXSTAB. 

Specifically  then  In  the  Airplane  Definition  section  of  Level  2.01 
FLEXSTAB,  the  Geometry  Definition  (GD)  and  the  associated  CALCOMP  program 
(GDPLOT)  of  Level  1.01  have  been  combined  In  Level  2.01  to  facilitate  the 
conversion  of  the  scaled  configuration  drawings  of  the  aircraft  Into  the 
spatial  mathematical  descriptions  required  by  the  subsequent  downstream 
programs  of  Level  2.01.  The  Aerodynamic  Influence  Coefficient  (AlC)  program 
of  the  Level  2.01  System  Is  structured  to  include  both  the  steady  and  Icw- 
frequency  unsteady  aerodynamic  programs  of  Level  1.01.  The  Internal 
Structural  Influence  Coefficient  (ISIC)  and  Normal  Modes  (NM)  prograns  and 
the  External  Structural  Influence  Coefficient  (ESIC)  program  of  Level  1.01 
have  been  modified  to  provide  structural  data  to  mathematically  represent 
15  types  of  flight  control  sensors.  In  the  airplane  Stability  Evaluation 
Section  of  Level  2.01,  the  Stability  Derivative  and  Static  Stability  (SD+SS) 
and  the  Characteristic  Equation  Rooting  (CER)  programs  of  Level  1.01  have 
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been  cotifcined  to  facilitate  the  controls- fixed  aircraft  analysis.  In  the 
position  previously  occupied  by  the  CER  program  of  Level  1.01,  a new  Linear 
Systems  Analysis  (LSA)  program  for  controls-free  at rcraft  analysis  is  included 
In  Level  2.01.  The  Level  1.01  FLEXSTAB  Time  Histories  (TH)  program  is 
modified  so  that  Level  2.01  may  analyze  the  response  of  controls-f ixed  and 
controls-free  flexible  aircraft  that  are  perturbed  by  deterministic  gusts 
or  control  surface  disturbances.  The  remaining  Graphical  Display  programs 
of  Level  2.01,  i .e. , Elastic  Axis  Plot  (EAPLOT) , Normal  Modes  Plot  (NMPLOT) , 
and  Pressure  Distribution  Plot  (PDPLOT),  and  the  Auxiliary  progratrs  of  Level 
2.01,  i.e..  Corrected  Aerodynamic  Influence  Coefficient  (CAIC),  and  Structural 
Loads  (SLOADS)  are  only  slightly  altered  from  their  Level  1.01  FLEXSTAB  form. 

The  net  cost/effectiveness  of  these  changes  from  the  Level  1.01  to 
Level  2.01  FLEXSTAB,  as  well  as  the  contracted  and  the  in-house  modifications 
to  the  CDC  computers  at  WPAFB,  is  shown  in  Figure  3*  initially,  the  Level 
1.01  FLEXSTAB,  as  implemented  at  WPAFB  in  February  1973»  required  17  workdays, 
72  manhours,  and  18,000  confute r resource  seconds  to  perform  a single  design 
point  analysis  of  a high  aspect  ratio  aircraft  using  a moderate  sized  math 
model  that  consisted  of  200  aerodynamic  influence  coefficients  (AlC's).  A 
computer  resource  second  is  defined  to  be  the  total  of  the  Central  Processor 
seconds  added  to  one-half  the  Input/Output'seconds  (CP  + 1/2  iO). 

Presently,  the  Level  2.01  FLEXSTAB  analyses  require  substantially  less 
workdays,  manhours,  and  computer  seconds  at  WPAFB.  As  an  example,  the 
Control  Criteria  Branch  performed  a conceptual  design  analysis  (Reference  7) 
of  a Spanloader  aircraft,  Figure  4,  inspired  by  the  Lockheed  Spanloader  pre- 
sented In  Reference  8.  This  In-house  analysis  required  approximately  3 
workdays,  5*7  manhours,  and  10,000  computer  resource  seconds.  In  fact,  a 
substantially  greater  number  of  Level  2.01  FLEXSTAB  analyses  were  performed, 
at  approximately  1/2  the  computer  costs  of  the  Level  1.01  FLEXSTAB  analyses. 

An  examination  of  the  differences  in  the  workdays  indicates  that  10  days 
were  removed  due  to  the  purchase  of  a second  CDC  6600  computer  for  WPAFB.  The 
remaining  8 days  were  reduced  to  3 via  the  streamlining  of  the  program  and 
the  specialization  of  the  System  to  the  computer  software  of  the  CDC  computer 
system  at  WPAFB.  The  reduction  in  the  expended  manhours  can  be  attributed 
to  several  things.  Approximately  20  hours  of  the  reduction  can  be  attributed 
to  experience  gained  in  using  the  System  over  the  past  two  years.  The  major 
manpower  savings  is  accomplished  in  the  operation  of  the  IS  1C  program  due  to 
the  creation  of  an  interface  program  that  simplifies  the  input  of  elastic  axis 
and  lumped  mass  locations,  thus  eliminating  user- gene rated  errors.  Manpower 
savings  were  also  accomplished  in  the  GD  and  SD+SS  programs  by  rewriting 
the  input  data  formats  to  highlight  redundant  data  inputs  and  to  redefine 
the  input  data. 


Analysis  and  Evaluation  Capability  of  Level  2.01  FLEXSTAB 


i 

The  basic  analysis  and  evaluation  capability  of  the  Level  2.01  System 
is  substantial,  being  best  illustrated  by  detailed  descriptions  of  what  each 
major  program  In  the  System  will  do.  In  general,  the  Level  2.01  System 
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estimates  the  static  and  dynamic  stability  and  control  parameters  of  controls- 
fixed  and  controls-f ree  flexible  aircraft  over  a Mach  number  range  of  0.0 
to  approximately  3.5.  The  System  is  applicable  to  complex,  three-dimensional 
aircraft  configurations,  e.g. , vertical  tails  located  on  the  outboard  portions 
of  the  wing,  T-tails,  nacelles  suspended  from  struts,  and  close-coupled 
canards  and  wings.  The  steady  aerodynamic  theory  of  the  System  is  an  advanced 
version  of  the  method  developed  by  Woodward,  Tinoco,  and  Larsen  (Reference  9), 
in  which  constant  pressure  vortex  panels,  constant  strength  source  panels, 
line  doublets,  and  line  sources  represent  the  linear  potential  flow  aero- 
dynamics about  the  flight  vehicle.  In  addition,  the  aerodynamic  program  of 
the  System  contains  a recently-developed  (Reference  10),  low-frequency  unsteady 
aerodynamic  approximation  that  extends  the  basic  steady  aer^dynamjc  method  to 
the  calculation  of  unsteady  aerodynamic  derivatives,  e.g.,  a,  q,  5s>  l>  i*  and 
p derivatives,  as  well  as  the  "generalized  modal  aerodynamics."  The  low-fre- 
quency approximation  is  unique  in  that  it  has  the  same  general,  three-dimen- 
sional capability  of  the  steady  aerodynamics  method  at  both  subsonic  and  super- 
sonic speeds.  This  feature  eliminates  the  redefinition  of  the  influence  coef- 
ficient geometry  with  Mach  number  and  also  the  "diaphragm  region"  of  the  exist- 
ing Mach  Box  supersonic  method. 

There  are  two  structural  influence  coefficient  methods  within  the  System. 
One  method  Is  based  upon  the  elastic  axis/lumped  mass  approximation  usually 
employed  on  high  aspect  ratio  aircraft.  In  this  method  (ISIC  and  NM  programs 
of  Figure  2),  the  structure  of  the  aircraft  is  replaced  by  a connected  con- 
figuration of  beams  with  speci fied  bending  and  torsional  stiffness  properties. 
This  math  model  is  used  to  calculate  the  stiffness  and  the  flexibility 
matrices,  the  aircraft  inertial  characteristics,  and  the  invacuum  vibration 
eigenvalues  and  eigenvectors  of  the  free-free  structure.  The  structural  and 
inertial  matrix  coefficients  are  transformed  Into  a mathematical  format  that 
is  compatible  with  the  steady  and  unsteady  aerodynamic  influence  coefficients. 
Once  the  aerodynamic  and  Structural  influence  coefficients  exist  in  a compat- 
ible numerical  format,  the  subsequent  programs  in  the  System  can  calculate  the 
stability  and  control  parameters  of  the  rigid  and  flexible  aircraft. 

The  second  structural  influence  coefficient  method  In  the  System  (ESIC 
program  of  Figure  2)  contains  numerical  routines  that  accept  influence  coef- 
ficients from  an  "external"  finite  elements  programs,  such  as  NASTRAN,  and 
then  converts  them  to  a form  compatible  with  the  aerodynamic  influence  coef- 
ficients. Thus,  ESIC  provides  the  System  user  with  an  accurate  structural 
influence  coefficient  representation  of  the  aircraft  that  is  most  useful  in 
the  advanced  design  cycle  of  aircraft  development. 

As  noted  before,  the  aerodynamic  and  structural  influence  coefficients 
are  summed  for  the  static  and  dynamic  aeroelastic  stability  and  control 
calculations  by  the  other  programs  in  the  System.  These  System  programs 
(SD+SS,  LSA,  and  TH  programs  of  Figure  2)  calculate  the  stability  and  control 
derivatives,  the  static  and  dynamic  stability,  the  aerodynamic  loads  on  the 
maneuvering  aircraft,  and  the  deformed  shape  of  the  flexible  aircraft.  The 
SD+SS  program  of  the  System  (Reference  11)  allows  for  initial  conditions -of 
non-accelerating  dynamic  motions  consisting  of  constant-magnitude,  angular 
pitch,  roll,  and  yaw  rates  and  linear  translational  rates,  singularly  or  in 
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combination.  The  engine  gyroscopic  effects  are  included  at  the  user's  option. 
Once  the  initial  conditions  of  motion  are  defined  in  SD+SS  and  the  trim  or 
specified  shape  of  the  aircraft  defined,  the  analyses  of  symmetric,  asym- 
metric, or  coupled  perturbation  dynamic  motions  is  possible  using  (l)  a char- 
acteristic equation  rooting  method,  if  the  perturbation  equations  are  linear 
ordinary  differential  equations,  or  (2)  a Runge-Kutta  integration  method  of 
the  TH  program,  if  the  differential  equations  are  nonlinear  or  the  system 
is  excited  by  deterministic  gust  and  control  disturbances. 

The  Stability  Derivative  and  Static  Stability  (SD+SS)  program  also 
contains  numerous  options  that  connect  the  Level  2.01  FLEXSTAB  to  the  exist- 
ing experimental  and  semi -empi  ri  cal  methods  of  analysis.  As  an  example,  the 
stability  and  control  data  measured  during  wind  tunnel  tests  of  rigid  force 
and  hinge  moment  models  of  aircraft  may  be  incorporated  as  tables  of  data, 
e.g.j  CL(a,  6$)  and  Cn(a,  3),  or  as  derivatives  at  the  trim  point,  e.g., 

C|_„  and  Cng.  If  the  wind  tunnel  measurements  are  unavailable,  a semi -empiri- 
caT  method  such  as  Datcom  (Reference  12)  may  be  used  instead. 


The  Linear  Systems  Analysis  (LSA)  program  of  Level  2.01  FLEXSTAB  is  of 
particular  interest  to  analysts  of  CCV-type  ai  rcraft.  As  Implied  previously, 
the  computer  mechanization  of  the  routine  engineering  computations  Involved  In 
CCV  analyses  Improves  the  analysis  cycle  time  and  analysis  accuracy,  because 
the  computer  does  not  make  mistakes  due  to  fatigue  or  boredom.  The  specific 
CCV-type  calculations  that  have  been  mechanized  in  LSA  (Reference  13)  are: 

The  construction  of  an  LSA  precompi ler,  that  accepts  user  specified 
control  system  transfer  functions  as  a ratio  of  high  order 
polynominals  in  the  Laplacian  variable,  and  then  internally 
rearranges  these  elements  into  a standard  matrix  format  for 
Root  Locus,  Bode,  Nyquist,  and  Power  Spectral  Density  analyses. 

The  construction  of  accelerometer,  rate  gyro,  angular  position,  air 
speed,  and  inertial  velocity  sensor  equations  as  an  integral  part 
of  the  overall  LSA  calculations. 

The  construction  of  a Pade"  polynomial  approximation  of  the  gust 
and  the  turbulence  penetration  exponential,  per  user  specified 
tolerances . 

A built-in  Von  Karman  Power  Spectral  Density  model  to  represent 
the  turbulence  excitation  of  the  flexible,  controls -fixed  and 
controls-free  aircraft.  The  user  may  input  his  own  turbulence 
model  if  he  so  desires. 

Options  that  permit  a user  to  "delete"  or  "reduce"  selected  invacuum 
modes  via  the  MODAL  TRUNCATION  or  the  RESIDUAL  FLEXIBILITY  formu- 
lations that  are  discussed  in  the  next  section  of  this  paper. 

An  option  to  pundi  on  cards,  in  a standard  fornnat,  the  matrix 
equations  of  motion  of  the  aircraft  and  the  sensors  for  the  user 
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to  Input  to  flight  simulators  and  other  interfacing  stability 
and  control  computer  programs. 

The  input  and  output  data  of  the  programs  are  graphically  presented  by 
five  CALCOMP  programs  that  are  interconnected  to  the  main  analysis  proigrams 
of  the  System  by  overlay,  cards,  or  magnetic  tape  (TAPE  99  in  Figure  2). 
These  CALCOMP  programs  present  the  geometric  orientation  of  the  aerodynamic 
and  structural  elements  of  the  math  model  of  the  aircraft,  the  invacuum 
eigenvectors,  the  aerodynamic  load  distributions,  and  the  time  history 
responses . 

Two  programs  in  the  Level  2.01  FLEXSTAB  are  intended  primarily  for 
design.  One,  Corrected  Aerodynamic  influence  Coefficient  (CAlC  program  of 
Figure  2)  is  used  to  correct  the  aerodynamic  influence  coefficients  for  non- 
linear effects  via  correction  factor  matrices.  The  second,  Structurai  Loads 
(SLOADS  program  in  Figure  2),  calculates  the  aerodynami c and  inertial  compo- 
nent loads  along  the  elastic  axes,  if  the  beam  structural  math  model  is 
employed. 


ESTABLISHMENT  OF  CRITERIA  FOR  THE  APPLICATiON  OF  LEVEL  2.01  FLEXSTAB 


The  Level  2.01  FLEXSTAB  contains  numerous  user  options  that  permit 
varied  types  of  aeroelastic  stability  and  control  analyses.  A unifying 
concept  in  the  System  is,  that  no  matter  which  of  the  options  are  selected, 
one  of  the  major  results  is  the  creation  of  the  equations  of  motion  using 
the  aerodynamic,  structural,  and  inertial  matrices.  These  equations  of 
motion,  and  the  attendant  sensor  and  loads  equations,  consist  of  three  inter- 
related formulations,  QUASI  STATIC,  RESIDUAL  FLEXIBILITY,  and  MODAL  TRUNCATION, 
that  describe  the  dynamics  of  the  cont rols-fl xed  and  controls-free  aircraft. 

The  Industry  surveys  mentioned  at  the  beginning  of  this  paper  indicated 
that  all  of  the  formulations  were  used  to  a degree,  but  that  the  QUASI  STATIC 
and  MODAL  TRUNCATION  formulations  were  the  most  common.  As  examples: 

The  XB-70  GASDSAS,  B-52E  LAMS,  B-52E  CCV,  C-5A  ALDCS,  F-4  Survivable 
Flight  Controls,  F-A  CCV,  F-111,  and  F-15  aircraft  projects 
applied  the  QUASI  STATIC  and  MODAL  TRUNCATION  formulations. 

The  initial  AFFDL  sponsored  studies  of  a CCV-type  bomber,  transport, 
and  fighter  aircraft  applied  the  QUASI  STATIC  and  a combination 
of  the  MODAL  TRUNCATION  and  RESIDUAL  STIFFNESS  formulations. 

The  SST  design  studies  applied  the  QUASI  STATIC,  MODAL  TRUNCATION, 
and  RESIDUAL  STIFFNESS  formulations.  The  B-1  design  studies 
applied  the  QUASI  STATIC,  MODAL  TRUNCATION  and  RESIDUAL  STIFFNESS 
fo  rmu  1 at  i ons . 

The  industry  and  government  have  developed  criteria  for  the  selection  of 
the  QUASI  STATIC  formulation.  However,  there  are  few  criteria  to  guide  the 
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selection  of  the  other  formulations  of  the  equations  of  motion.  The  criteria 
are  necessary  because  they: 

Force  the  flight  ccwitrol  analysis  to  be  consistent  with  the  flutter 
and  structural  loads  analyses  of  CCV-type  aircraft. 

Provide  a qualification  for  the  associated  handling  quality  and 
ride  quality  criteria  studies. 

Provide  a rational  to  the  USAF  and  the  other  government  agencies 
to  be  used  in  the  evaluation  of  competing  CCV-type  aircraft. 

Identify  the  configuration  development  problems  created  by  the 
application  of  each  formulation. 

Place  upper  limits  on  the  complexity  to  be  tolerated  in  CCV-type 
coptrol  systems  that  are  designed  using  each  of  the  approximate 
formulations. 

Determine  the  risks  associated  with  the  relaxation  of  criteria. 

The  AFFDL  Control  Criteria  Branch  Initiated  a study  in  1971“1972  to 
supply  these  criteria  as  part  of  the  Development  plan  for  Level  2.01  FLEXSTAB. 
As  a first  Step,  the  six  linear  formulations  of  the  equations  of  motion  were 
Identified  and  mathematically  related  using  the  notation  of  the  FLEXSTAB 
documentation: 

EXACT  - The  motion  of  the  structure  is  determined  by  eigenvalue 
(root)  and  eigenvector  (mode  shape)  solutions  of  the  equations 
of  motion  for  the  elastic  aircraft.  The  mode  shape  coordinates 
contain  complex  nunfcers.  The  accuracy  of  the  solution  is  limited 
by  the  existing  computerized  routines  that  calculate  the  complex 
number  eigenvalues  and  eigenvectors. 

MODAL  SUBSTITUTION  - The  motions  of  the  structure  are  assumed  to  be 
. related  to  the  orthogonal,  invacuum  eigenvectors  (mode  shapes). 

The  eigenvectors  contain  only  real  nutifcers. 

RESIDUAL  STIFFNESS  - The  mode  shapes  representing  the  elasti c motion 
in  the  MODAL  SUBSTITUTION  formulation  are  separated  into  "retained" 
and  "deleted"  modes.  The  deleted  modes  are  represented  in  the 
dynamic  stability  analysis  as  quasi  static  aeroelastic  corrections, 
using  a correction  factor  related  to  the  deleted  modes  and  the 
stiffness  matrix  of  the  free-free  structure. 

RESIDUAL  FLEXIBILITY  - Similar  to  the  RESIDUAL  STi FFNESS  formulation, 
except  the  quasi  static  aeroelastic  correction  is  related  to  the 
retained  tirodes  and  the  flexibility  matrix  of  the  free-free 
structure. 

MODAL  TRUNCATION  - The  deleted  modes  of  the  RESIDUAL  STIFFNESS  and 
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REPRODUCBILITY  OF  THi 
0RI(»14L  FAaE  IS  POOR 


RESIDUAL  FLEXIBILITY  formulations  are  not  represented  by  any 
correction  factor.  This  is  the  most  common  dynamic  aerbeVastic 
formulation  reported  in  the  literature. 

QUASI  STATIC  - The  motions  of  the  structure  are  assuraed  to  be 
in-phase  with  the  rigid  body  motions.  The  method  is  used 
primarily  for  the  conceptual  and  preliminary  design  of  handling 
quality  and  reduced  static  stability  control  systems  for  elastic 
aircraft  with  a wide  frequency  separation  between  the  axis 
system  motions  and  the  structural  deformations. 

A contrast  of  the  computational  difficulties  and  the  unique  features 
of  each  of  the  formuiations  is  found  in  Tables  1 and  2.  As  shown,  the  EXACT 
and  MODAL  SUBSTITUTION  formulations  consist  of  a large  number  of  equations 
that  must  be  solved  simultaneously  and,  in  most  cases,  their  number  precludes 
their  use  in  the  design  of  flight  control  systems.  The  RESIDUAL  STIFFNESS 
and  RESIDUAL  FLEXIBILITY  formulations  provide  equivalent  numerical  results, 
despite  the  differences  in  matrix  formulation. 

During  the  analytical  studies  to  mathemati cal  ly  relate  the  various 
formulations,  it  became  apparent  that  a general . cri teria  for  the  selection 
of  each  formulation  could  be  stated  in  terms  of  the  major  assumptions  that 
are  required  to  derive  each  formulation  (Reference  H).  These  major  assump- 
tions are  presented  in  Figure  5.  An  examination  of  Figure  5 reemphasizes 
that  it  is  relatively  easy  to  decide  when  the  QUASI  STATIC  formulation  is 
appropriate.  However,  the  decision  on  the  appropriateness  of  the  RESIDUAL 
formulations  or  the  MODAL  TRUNCATION  formulation  is  considerably  more 
difficult.  The  difficulty  arises  due  to  the  necessity  to  numerically  evalu- 
ate the  significance  of  the  "structural  spring  forces,"  A8,  and  the  "aero- 
dynamic forces  of  structural  deformation,"  A9  upon  the  performance  of  the 
flight  control  system. 

Presently,  most  of  the  aeroelastic  stability  and  control  design  methods 
in  use  In  the  industry  do  not  possess  the  capability  to  evaluate  these  terms 
for  their  numerical  significance  to  the  dynamics  of  the  flexible  ai  rcraft. 

In  contrast,  the  Level  2.01  FLEXSTAB  is  specifically  engineered  and  coded 
to  provide  the  USAF  with  the  capability  to  consider  both  formulations,  and 
thus,  to  evaluate  the  numerical  significance  of  A8  and  kS  when  applied  to 
the  design  of  any  proposed  aircraft.  This  new  capability  in  Level  2.01 
should  provide  additional  information  concerning  the  interaction  of  modern 
flight  control  systems  with,  the  structural  dynamics  of  aircraft. 

The  aeroelastic  stability  and  control  parameters,  to  be  calculated 
with  the  Level  2.01  FLEXSTAB  during  the  check-out  using  the  aircraft  presented 
in  Table  3>  will  provide  more  Specific  numerical  criteria  for  the  selection 
of  either  the  RESiDUAL  FLEXIBILITY  or  MODAL  TRUNCATION  formulations  of 
Level  2.01  FLEXSTAB.  The  bomber/ transport  aircraft  category  is  receiving 
first  attention  due  to  their  significant  aeroelasti  ci  ty  at  all  flight  condi- 
tions. Once  the  numerical  criteria  are  generated  for  this  category,  the 
fighter  category  of  aircraft  will  then  be  considered.  Here,  the  emphasis 
will  be  placed  upon  the  unique  fighter  aircraft  maneuvers  that  are  comprised 
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of  large  rates  of  rotation  and  high  load  factors. 


FUTURE  DEVELOPMENT  OF  LEVEL  2.01  FLEXSTAB 


The  Level  2.01  FLEXSTAB  Is  nearing  the  completion  of  the  first  cycle  of 
funding  action  that  was  intended  to  provide  AFFDL  and  the  USAF  with  the 
capability  to  perform  basic  analysis  and  evaluation  of  conventional  and  CCV- 
type  aircraft.  As  mentioned  previously,  the  contractor  and  the  AFFDL  Control 
Cri teri a Branch  decided  early  in  the  program  that  the  high  risk  technical 
areas  should  be  identified  prior  to  beginning  the  extensive  engineering  or 
programming  work  In  these  high  risk  areas  of  analysis.  There  are  two  areas 
of  high  risk  that  have  been  identified  for  AFFDL  In-house  and  contractual 
studies  in  FY75-76: 

The  application  of  the  low-frequency  unsteady  aerodynamics  to  the 
calculation  of  turbulence  and  gust  Induced  aerodynamic  forces. 

The  Identification  of  a suitable  test  case  to  verify  the  engineer- 
ing and  the  coding  of  Level  2.01  FLEXSTAB. 

The  test  application  of  the  low  frequency  unsteady  aerodynamic  method 
to  the  calculation  of  unsteady  aerodynamic  stability  and  control  derivatives 
such  as  Cm^,  Cng»  Cj!,p,  and  Cmgg  and  the  low-frequency,  generalized  aero- 

dynamic forces  has  been  "successful"  to  date.  By  successful  is  meant  that 
"reasonable"  correlation  has  been  achieved  on  most  test  cases.  The  doublet 
lattice  and  the  unsteady  aerodynamic  strip  theory  methods  provide  partial 
checks  at  subsonl c speeds.  At  supersonic  speeds  there  are  no  comparable 
theoretical  methods  that  can  represent  the  complex  flow  field  around  three 
dimensional  aircraft  configurations.  Ideally,  the  Level  2.01  estimates 
should  be  compared  to  experimental  data,  as  well  as  existing  analytical  data. 
However,  the  comparison  to  the  experimental  data  will  require  the  development 
of  the  parameter  estimation  method  for  flexible  aircraft,  to  be  discussed 
in  the  latter  paragraphs  of  this  section  of  the  paper. 

The  low  frequency  unsteady  aerodynamics  have  proven  to  be  marginally 
acceptable  to  unacceptable  for  the  calculation  of  atmospheric  gust  and 
turbulence  Induced  aerodynamic  forces.  The  problem  In  the  Level  2.01  turbu- 
lence analyses  is  that  the  calculation  of  the  Power  Spectral  Density  of  a 
parameter  such  as  vertical  acceleration  due  to  vertical  gusts,  a^/wg, 
requires  the  integration  of  the  square  of  the  frequency  domain  representation 
of  the  az/wg  transfer  function,  multiplied  by  the  turbulence  Power  Spectral 
Density.  This  Integration  over  all  frequencies  does  not  converge  due  to 
the  neglect  of  the  higher  order  unsteady  aerodynamic  effects  by  the  low 
frequency  aerodynamics  method.  The  contractor,  Air  Force  Office  of  Scientific 
FJesearch,  and  the  Control  Criteria  Branch  have  studied  the  numerical  problem 
in  detail  and  identified  the  contributions  of  the  individual  terms  of  the 
transfer  functions.  There  are  four  possible  solutions: 
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Incorporation  of  the  Kussner-Wagner  functions  per  conventional 
design  practices. 

Addition  of  the  doublet  lattice  aerodynamic  methods  for  turbulence 
analysis  at  subsonic  speeds. 

Retention  of  the  next  higher  order  frequency  terms  In  the  asymp- 
totic expansion  of  the  unsteady  aerodynamic  potential  flow 
equations. 

Expansion  of  the  unsteady  potential  flow  equations  for  "large 
frequencies"  and  then  "matching"  of  the  low  and  high  frequency 
solutions  for  Intermediate  frequencies. 

The  first  option  is  the  obvious  short  term  solution  for  Level  2.01, 
since  only  a small  Increase  In  the  computer  costs  Is  Involved  In  using  the 
System.  The  Incorporation  of  the  doublet  lattice  method  Into  the  System  is 
attractive,  since  I t has  become  an  accepted  design  method.  Unfortunately, 
this  solution  may  require  extensive  modification  of  the  System,  and  thus 
eliminate  some  of  the  unique  CCV  analysis  options  currently  available,  e.g. , 
the  Inclusion  of  the  forward  speed  degree  of  freedom  In  the  dynamics,  the 
multiple  equation  of  motion  formulations  discussed  In  the  preceeding  section 
of  this  paper,  and  the  very  general  Initial  conditions  of  motion.  NASA  has 
contracted  to  study  this  problem  In  detail.  In  addition,  the  Air  Force 
Office  of  Scientific  Research  has  funded  fundamental  studies  related  to  the 
unsteady  aerodynamics  methods  applied  to  stability  and  ccxitrol  analyses. 

The  third  and  fourth  solutions  are  theoretically  Interesting,  but  unproven 
mathematically.  Regardless,  the  Incorporation  of  the  latter  3 solutions  Is 
a relatively  long  term  process  requiring  several  extensive  program  check 
cases.  These  check  case  data  are  presently  being  collected  during  studies 
at  AFFDL  using  the  existing  Level  2.01  programs  and  will  be  available  for 
the  future  unsteady  aerodynamic  improvements  to  the  Level  2.01  FLEXSTAB.  The 
Incorporation  of  the  Kussner-Wagner  functions  and  the  correlation  of  Level 
2.01  FLEXSTAB  analytical  estimates  to  the  C-5A  or  the  B-52E  flight  test 
data  has  been  planned  for  FY75> 

As  mentioned,  a new  computer  program  requires  extensive  verification 
of  the  engineering  equations  and  of  the  program  coding.  The  development  of 
the  13  programs  of  Level  2.01  FLEXSTAB  compounded  the  verification  problems. 

In  that  the  check  data  on  aircraft  tedinology  integration  and  the  check  data 
on  the  correlation  of  existing  design  methods  to  flight  test  data  is  prac- 
tically non-existent.  Ample  amounts  of  wind  tunnel  test  data  on  rigid  ai  r- 
craft models  are  available,  along  with  comparisons  to  the  other  analytical 
methods.  These  data  verify  only  the  steady  aerodynamic  methods.  Some 
static  and  dynamic  structural  data  from  ground  vibration  tests  are  available, 
but  test  conditions  and  parameters  are  not  entirely  suited  to  computer 
program  check-outs;  often  these  ground  tests  do  not  have  a comparable  flight 
test  counterpart.  The  statl c-elasti c al rcraft  models,  cantilevered  from 
stings  or  struts  during  wind  tunnel  tests,  provide  excellent  checks  of  basic 
static  aeroelastic  calculations,  but  again  little  data  is  presently  available. 
The  cable-mounted  flutter  models  provide  some  verification  of  dynamic 
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aeroelastic  calculations,  although  cable  friction  and  umbiUcal  cord  drag 
add  incalcuable  factors. 

The  Level  2.01  contractual  test  case  consisting  of  the  B-52E  LAMS  at 
Flight  Condition  Number  1 has  provided  mixed  results.  This  is  because  the 
LAMS  data  were  not  intended  for  check  cases  for  new  computer  programs  and, 
thus,  they  were  not  qualified  and  correlated  in  any  great  detail  to  the 
results  of  the  LAMS  design  methods.  For  example,  the  generalized  structural 
damping  added  to  each  structural  mode  was  not  documented  and  has  been 
assumed  to  be  5 = 0.03  in  the  Level  2.01  check  case.  Additionally,  typo- 
graphical errors,  such  as  sign  errors  in  the  summation  of  the  LAMS  feedback 
loops  exist  inadvertently  in  the  formal  AFFDL  documentation.  Numerous 
additional  questions  arise  in  the  correlations  between  the  results  of  the 
Level  2,01  FLEXSTAB  and  the  flight  test  that  cannot  be  answered  because  the 
basic  LAMS  calculations  were  not  preserved. 

To  date,  the  AFFDL  Control  Criteria  Branch  has  been  unable  to  find  a 
suitable  operational  aircraft  that  can  check  the  Level  2.01  program  to  the 
degree  desired.  As  such,  the  Control  Criteria  Branch  has  decided  to  select 
the  best  data  from  the  aircraft  and  aircraft  model  wind  tunnel  tests  that 
are  presented  in  Table  3*  Each  ai  rcraft  •or  model  checks  an  area  of  major 
calculation  within  the  System.  To  whatever  extent  possible,  the  experimental 
data  and  the  Level  2.01  analytical  estimates  will  be  compared  to  the  esti- 
mates of  the  contemporary,  parochial  analytical  methods.  The  contrast  of 
the  Level  2.01  calculations  to  the  calculations  of  parochial  design  methods 
of  the  aerospace  industry  is  particularly  important,  since  it  qualifies  the 
inaccuracies  of  FLEXSTAB,  while  providing  a historical  background  to  measure 
the  progress  of  research  and  development.  The  major  contracted  test  cases 
are  with  the  B-52E  and  the  F-111  TACT  aircraft  and  flexible  model;  the 
remainder  are  in-house  check  cases.  The  manpower  and  computer  cost  of  the 
in-house  effort,  approximately  60,000  dollars,  is  considerably  less  than 
the  costs  of  a single  wind  tunnel  test  of  either  a rigid  or  a flexible  model 
of  an  ai rcraft . 

It  should  be  noted  that  the  data  collected  during  these  check  case 
studies  of  Level  2.01  are  extremely  valuable.  The  data  provide  a mathe- 
matical representation  of  the  current  LISAF  vehicles  for  AFFDL  support  to 
the  System  Program  Office  (SPO)  and  for  the  development  of  future  analyt- 
ical methods  by  AFFDL. 

In  addition  to  funding  the  unsteady  aerodynamics  improvement  and  the 
additional  B-52E  and  F-111  TACT  test  cases,  AFFDL  Control  Criteria  Branch 
has  decided  to  begin  studies  in  four  areas  directly  or  indirectly  related 
to  Level  2.01: 

Modification  of  the  System  to  allow  the  analysis  of  sting-  and 
strut-mounted  flexible  models  that  are  tested  in  wind  tunnels. 

Creation  of  a structural  loads  analysis  module  that  interfaces 
with  the  System  and  that  provides  a numerical  measure  of  the 
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effectiveness  of  the  CCV  control  system.  This  necessitates  the 
study  of  the  sensor  equations  that  are  appropriate  to  each  of 
the  math  models  of  the  dynamics  of  the  aircraft. 

Creation  of  an  optimal  control  synthesis  module  that  may  be 
Interfaced  with  the  System. 

Creation  of  a parameter  estimation  method  for  flexible  aircraft 
to  provide  experimental  check  data  for  Level  2.01  from  flight 
tests  of  aircraft. 

In  FY75"76,  the  Control  Criteria  Branch  will  study  the  difficulties 
Involved  In  adding  the  capability  for  the  analysis  of  static  aeroelastic 
mode^ls  that  are  tested  In  wind  tunnels.  Conceptually,  this  modification 
to  Level  2.01  requires  relatively  minor  changes  to  the  System:  the  elimina- 

tion of  the  "inertia  relief"  and  the  "free-free  flexibility  matrix"  calcula- 
tions In  iSIC/NM,  ESIC,  and  SD+SS  programs  (Figure  2)  that  are  required  for 
aircraft,  but  not  for  static  aeroelastic  models.  The  F-111  TACT  flexible 
model  serves  as  a check  case  for  this  modification,  as  well  as  an  element 
In  tile  overall  System  verl  f I cation  discussed  previously.  Pressure  data  will 
be  Incorporated  into  the  analyses  of  the  F-111’ TACT  flexible  model  and  ai  r- 
craft to  further  facilitate  the  numerical  checks  of  the  coding. 

The  FY75  studies  will  also  Investigate  and  define  the  form  of  the  loads 
analysis  equations  that  reflect  the  Improvements  or  the  degradations  to  the 
structural  loads  due  to  the  operation  of  the  CCV-type  control  systems.  This 
study  will  include  an  Investigation  into  the  elastic  correction  factors  on 
the  accelerometer  equations  of  motion  found  In  the  QUASI  STATIC  and  the 
RESIDUAL  FLEXlBlLiTY  math  models  of  flexible  aircraft  dynamics. 

The  Incorporation  of  the  optimal  control  synthesis  methods  as  a feature 
of  the  Auxiliary  Programs  of  the  Level  2,01  FLEXSTAB  is  currently  being 
studied  in-house  by  the  Control  Criteria  Branch  (Reference  15).  The  aero- 
dynamic program  (AlC  program  of  Figure  2)  Is  particularly  attractive  In 
this  study.  In  that  It  formulates  the  equations  of  motion  In  the  time, 
Laplaclan,  and  frequency  domain  of  mathemati cal  analysis.  This  uniqueness 
of  Level  2.01  FLEXSTAB  means  that  most  If  not  all  of  the  useful  optimal 
control  synthesis  methods  can  be  Interfaced  with  Level  2.01  FLEXSTAB.  This 
work  by  the  AFFDL  Control  Criteria  Branch  Is  closely  coordinated  with  the 
Active  Controls  Aircraft  Office  at  NASA/ARC  to  ensure  that  funding  duplica- 
tion Is  avoided  and  that  Independent  work  by  the  AFFDL  and  NASA  Is  available 
to  all.  The  FY75“76  study  in  optimal  control  will  use  the  C-5A  as  the  test 
case. 


The  application  of  parameter  estimation  methods  to  flexible  aircraft  Is 
receiving  substantial  attention  from  the  Control  Criteria  Branch  (Reference 
16).  There  are  several  motivating  factors  that  force  the  development  of 
this  type  of  Auxiliary  Program  for  the  Level  2.01  FLEXSTAB  . First,  the 
conparison  of  the  steady  and  unsteady  aerodynamic  parameters,  experimentally 
determined  by  flight  tests,  to  the  analytically  calculated  values,  is 
essential  to  ultimately  verify  the  accuracy  of  Level  2.01  FLEXSTAB,  or  any 
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other  aeroelastfc  analysis  program.  Without  these  types  of  verification  to 
qualify  the  precision  of  the  analytical  estimates  of  the  aerodynamic  param- 
eters of  importance  to  CCV  design,  the  innovative  use  of  CCV  concepts  may  be 
penalized  by  design  risk  factors  that  are  assumed  to  be  too  large.  Since  the 
existing  parameter  estimation  methods  treat  the  aircraft  as  a "rigid"  vehicle, 
a new  method  must  be  developed. 

Second,  the  practical  necessity  of  removing  all  excessive  structural 
weight,  whether  through  conventional  design  practices  or  through  active  con- 
trol systems,  has  resulted  in  vehicles  that  are  more  aeroelastic  than  previous 
vehicles  with  similar  operational  missions.  To  a degree,  all  flight  vehicles, 
including  fighter  aircraft,  are  aeroelastic.  The  degree  of  aeroelasti ci  ty 
depends  upon  the  particular  flight  condition  (Mach  number,  dynamic  pressure, 
and  mass  distribution)  at  which  measurements  or  observations  are  made.  In 
order  to  minimize  the  technical  risks  involved  in  the  design  of  these  type  of 
high  performance  vehicles,  a prototype  or  a pre-production  vehicle  is  often 
constructed  prior  to  committing  a large  amount  of  resources  to  a production 
vehicle.  The  SST  aircraft  are  obvious  examples.  The  intent  of  the  prototype 
vehicle  is  to  demonstrate  that  the  design  meets  ail  the  mission  objectives. 
This  demonstration  entails  flight  tests  of  the  prototype  to  verify  the  math 
models  employed  in  the  design  and  to  isolate  any  configuration  problems  that 
would  be  objectionable  in  the  production  vehicle.  Again,  since  the  existing 
parameter  estimation  methods  treat  the  flight  vehicle  as  a "rigid"  structure, 
they  eliminate  the  possibility  of  explicitly  identifying  important  aeroelastic 
parameters  that  affect  the  response  of  the  aircraft.  This  reason  further 
necessitates  the  development  of  a parameter  estimation  method  for  flexible 
ai rcraft. 

The  effort  in  parameter  estimation  consists  of  both  in-house  and  con- 
tractual work  planned  through  FY78,  As  a first  Step,  the  Control  Criteria 
Branch  is  developing  an  in-house  program  that  is  based  upon  the  maximum 
likelihood  method.  The  test  data  for  this  program  will  consist  of  B-52E  CCV 
flight  test  data  that  will  be  Selected  to  minimize  the  anticipated  numerical 
problems  discussed  in  Reference  16.  The  B-52E  CCV  analytical  start-up  data 
for  the  in-house  method  has  been  generated  using  the  Level  2.01  aerodynamic 
and  structural  finite  element  representation  presented  in  Figure  6.  A 
contracted  effort  will  compare  the  B-52E  CCV  aircraft  analytical  model  to 
flight  data  estimated  by  a method  being  developed  by  a contractor.  Both 
groups  of  these  parameter  estimates  will  be  correlated  to  flight  test  data 
measured  during  the  tests  of  the  dynamic  response  of  the  B-52E  to  step, 
ramp,  and  sinusoidal  motions  of  the  control  surfaces.  As  part  of  the  in-house 
effort,  the  iSIC  and  NM  programs  of  Level  2.01  FLEXSTAB  will  be  evaluated 
relative  to  the  methods  applied  to  the  B-52E  CCV  aircraft  by  the  contractor. 
The  purpose  of  the  evaluation  is  to  identify  any  inaccuracy  that  could  be 
introduced  in  the  in-house  developed  parameter  estimation  method  due  to  the 
theoretically  calculated  values  of  the  generalized  mass  and  stiffness  and  of 
the  invacuum  mode  shapes. 

The  next  phase  of  the  effort  will  involve  investigating  the  high  risk/ 
high  payoff  areas  of  parameter  estimation  of  flexible  aircraft  and  further 
developing  a production  computer  program.  The  final  phase  of  the  effort 
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will  Include  an  extension  of  the  linearized  methods  to  nonlinear  analyses. 


CONCLUDING  REMARKS 


The  Level  2.01  FLEXSTAB  Computer  Program  System  has  the  potential  to 
meet  most  of  the  immediate  needs  of  the  AFFDL  and  the  USAF  for  an  analysis 
and  evaluation  tool  of  conventional  and  CCV  aircraft.  Its  capability  for 
varied  aerodynamic  and  structural  finite  element  representations  of  the  con- 
trol s-fixed  and  the  controls- free  aircraft  provides  versatility  and  allows 
cost/effective  analyses  at  the  conceptual,  preliminary,  and  advanced  design 
levels  of  aircraft  development.  The  moduiar  independence  of  the  thirteen  ; 
programs  that  comprise  FLEXSTAB  facilitate  improvements  to  the  aerodynamic, 
structural,  dynamic,  and  flight  control  program  elements.  In  fact,  several 
USAF  and  NASA  efforts  are  presently  underway  or  planned  to  enhance  FLEXSTAB 
to  create  an  increase  in  capability  for  the  Level  3.01  FLEXSTAB  System. 

Of  particular  Importance  in  Level  2.01  FLEXSTAB  is  the  availability 
of  the  QUASI  STATIC,  the  MODAL  TRUNCATION,  and  the  RESIDUAL  FLEXIBILITY 
formulations  of  the  dynamics  of  aircraft.  These'  multiple  formulations  pro- 
vide a further  capability  for  cost/effective  analysis  of  the  dynamics  of 
both  the  control s-fixed  and  controls-free  flexible  aircraft.  The  numerous 
options  in  the  Level  2.01  programs,  for  the  inclusion  of  experimental  data 
to  improve  accuracy,  and  for  the  Interface  of  output  data  to  flight  simulators, 
optimal  control  synthesis  methods,  and  parameter  estimation  methods,  should 
make  the  Level  2.01  programs  a key  element  in  the  development  of  the  flight 
control  systems  of  future  military  aircraft. 

The  AFFDL  Control  Criteria  Branch  and  other  organizations  are  currently 
applying  Level  2.01  FLEXSTAB  to  the  analysis  and  evaluation  of  all  categories 
of  military  aircraft.  This  accrued  experience  is  available  to  other  inter- 
ested organizations  through  a liaison  officer  in  the  Control  Criteria  Branch. 
This  officer  is  responsible  for  any  request  to  the  AFFDL  for  a copy  of  the 
Level  2.01  FLEXSTAB  programs,  for  monitoring  the  successes  and  failures  of 
other  Level  2.01  users,  and  for  answering  user  questions.  Presently  several 
contractors  and  government  agencies  are  taking  advantage  of  the  service. 

Most  promising  is  the  decision  by  the  Mechanics  Department  of  the 
Air  Force  institute  of  Technology  (AFIT)  to  use  the  Level  2.01  FLEXSTAB 
programs  and  documentation  as  an  i 1 lustrative  tool  to  teach  the  intricacies 
of  combining  technologies  during  the  design  of  modern  aircraft.  These  USAF 
students  provide  valuable,  constructive  criticisms  to  the  AFFDL  Control 
Criteria  Branch.  Their  related  thesis  work  should  provide  new  and  often 
innovative  ideas  that  could  be  incorporated  Into  future  Levels  of  FLEXSTAB. 
Finally,  their  background  In  finite  element  programs,  such  as  FLEXSTAB, 
prepares  them  for  the  tasks  of  following  the  contractors  of  the  USAF  during 
the  conceptual,  preliminary,  advanced  design,  and  flight  test  phases  of  new 
aircraft  development,  or  during  the  contractual  modification  of  operational 
aircraft. 
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Figure  1.  Level  KOI  FLEXSTAB  Computer  Program  System 
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Figure  2.  Level  2*01  FLEXSTAB  Computer  Program  System 
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Table  1.  Computational  Difficulties  Associated  wl th  the 
Linear  Formulations  of  the  Equations  of  Motion 


ECONOMICS 

EIGENVALUE 

ROUTINE 

STRUCTURAL 

DATA 

REQUIRED 

METHOD 

PROGRAM 

SIZE 

PROGRAM 
RUN  Tl'ME 

REAL 

NUMBER 

COMPLEX 

NUMBER 

EXACT 

LARGE 

? 

- 

LARGE 

iKl 

MODAL  SUBSTITUTJON 

LARGE 

7 

LARGE 

LARGE 

EK] 

RESIDUAL  STIFFNESS 

MEDIUM 

LONG 

LARGE 

MEDIUM 

[K] 

RESIDUAL  FLEXIBILITY 

MEDIUM 

LONG 

MEDIUM 

MEDIUM 

[K]  AND  [C] 

MODAL  TRUNCATION 

MEDIUM 

MEDIUM 

MEDIUM 

MED! UM 

EK] 

QUASI  STATIC 

SMALL 

SHORT 

- 

SMALL 

EK] 

Table  2. 


Unique  Features  of  the  Formulations  Describing  Lightly 
Damped  Aircraft  Dynamics 


METHOD 

ADVANTAGES 

DISADVANTAGES 

MODAL  SUBSTITUTION 

PERMITS  COMPLETE  ANALYSIS  OF  LIGHTLY 
DAMPED  AIRCRAFT 

MOST  ACCURATE 

LIMITED  TO  LINEAR  OR  PIECEWISE 
LINEAR  SYSTEMS 

SLOWEST,  MOST  COSTLY 

“ RESIDUAL  STIFFNESS 

REDUCED; 

'NUMBER  OF  UNKNOWNS 
ANALYSIS  CYCLE  TIME 
COMPUTING  COSTS 

NEGLECTS  DYNAMICS  OF  DELETED 
MODES 

REQUIRES  ALL  INVACUUM  MODES 

RESIDUAL  FLEXIBILITY 

SAME  AS  RESIDUAL  STIFFNESS 

REQUIRES  ONLY  IN VACUUM  MODES  OF 
INTEREST 

REQUIRES  FREE- FREE  FLEXIBILITY 
MATRI X 

MODAL  TRUNCATION 

SAME  AS  RESIDUAL  FLEXIBILITY 
COMMON  ANALYSIS  TECHNIQUE 

NEGLECTS  STATICS  AND  DYNAMICS  OF 
DELETED  MODES 

QUASI  STATIC 

FASTEST,  LEAST  COSTLY 

NEGLECTS  ALL  DYNAMICS  OF 
STRUCTURAL  MOTION 

LEAST  ACCURATE 
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EHPBODUGBlLnY  OP  THE 
PAGE  IS 


DATA 

♦ AERODYNAMIC 
♦STRUCTURAL 
•VHERTiAL 
♦GEOMETRIC 


^ INERTIAL  ^ 
OR 

NON- INERTIAL 
SXOOROINATES> 


WON- INERTIAL 
BODY  FIXED  AXIS 


LINEAR 

OR 

HOH-LINEAR 
V SYSTEM  . 


EXACT 

FORMULATION 


" STATIC  ^ 
OR  DYNAMIC 
AEROELASTIC 
ANALYSIS  > 


QUASI  STATIC 


MODAL 

SUBSTITUTION 


RES  I DUAL 
STIFFNESS 


I RESIDUAL 
I FLEXIBILITY 


MODAL 

TRUNCATION 


MODAL 

TRUNCATION 


EXACT 

FORMULATION 


IS  > 
SYSTEM 
DAMPING 
^SIGNIFICANT 


EXACT 

FORMULATION 


ASSUMPTIONS 

A!  The  aerodynamic  forces  proportional 
to  structural  velocity  and  acceler- 
ation are  zero. 

A2  The  structural  inertial  and  damping 
forces  are  zero. 

A3  Structural  damping  forces  are  neg- 
ligible. 

AA  Aerodynamic  forces  due  to  elastic 
deformation  are  negligible. 

A5  The  aerodynamic  forces  due  to 

deleted  modal  velocity  and  acceler- 
ation are  zero. 

A6  The  structural  damping  and  Inertial 
forces  due  to  deleted  modal  deforma- 
tion are  zero. 

A7  The  structural  damping  of  retained 
inodes  on  deleted  modes  is  zero. 

A8  The  structural  spring  forces  of 
deleted  modes  are  zero. 

A9  The  aerodynamic  forces  due  to 
deleted  modes  arc  zero. 


General  Criteria  for  the  Selection  of  the  Formulation 
of  the  Equations  of  Motion  in  Level  2.01  FLEXSTAB 
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METHODOLOGY  FOR  DESIGN  OF  ACTIVE  CONTROLS 
FOR  V/STOL  AIRCRAFT 


George  Meyer  and  Luigi  Cicolani 
NASA  Ames  Research  Center 

ABSTRACT 

,An  effort  is  underway  at  the  Ames  Research  Center  to  develop  techniques 
fo'r  the  design  of  integrated,  fully  automatic  flight  control  systems  for 
powered  lift  STOL  and  VTOL  aircraft.  The  paper  describes  the  structure  of 
the  control  system  which  has  been  developed  to  deal  with  the  strong  non- 
linearities  inherent  in  this  class  of  aircraft;  to  admit  automatic  coupling 
with  the  advanced  ATC  requiring  accurate  execution  of  complex  trajectories; 
and  to  admit  a variety  of  active  control  tasks.  The  specific  case  being  con- 
sidered is  the  Augmentor  Wing  Research  Aircraft. 


INTRODUCTION 


NASA  through  its  STOL  and  VTOL  research  programs  is  investing  substantial 
resources  in  developing  powered  lift  technology.  In  all  cases,  the  wide  range 
of  lift  coefficient  required  to  cover  all  flight  conditions  between  cruise  and 
landing  is  achieved  by  in-flight  modification  of  aircraft  configuration. 

These  modifications  result  in  drastic  changes  in  control  characteristics  of 
the  aircraft,  and,  particularly  in  the  high-lift  transition  and  landing  con- 
figurations, the  aircraft  response  to  control  inputs  is  very  nonlinear.  More- 
over, the  presence  of  powered  and  direct  lift  generators  Increases  the  total 
number  of  controls  available  to  the  pilot  who  must  continually  make  decisions 
on  control  techniques.  Finally,  the  coming  short-haul  transportation  system 
will  be  required  to  satisfy  stringent  environmental  constraints  which  will 
necessitate  accurate  execution  of  complex  trajectories.  Accurate,  unaided 
manual  tracking  of  complex  trajectories  by  manipulating  a large  set  of  inter- 
acting controls  of  an  aircraft  whose  control  characteristics  are  non-linear 
and  rapidly  changing  represents  an  unacceptably  high  pilot  work  load.  Active 
control  technology  has  the  potential  to  provide  a means  for  reducing  the  pilot 
work  load  to  an  acceptable  level  by  integrating  control  functions  in  such  a 
way  as  to  generate  desirable  handling  qualities  without  reduction  in  the  per- 
formance of  the  aircraft  as  an  element  of  the  advanced  civil  air  transportation 
system.  The  advantages  of  active  control  technology  are  potentially  even  more 
substantial  in  military  applications  of  STOL  and  VTOL  aircraft.  Both  the 
Advanced  Military  STOL  and  the  Sea  Control  Fighter  VTOL  must  utilize  the 
maneuvering  capacity  of  the  basic  aircraft  to  the  fullest.  The  tracking  of 
complex  penetration  trajectories  must  be  sufficiently  accurate  for  proper  exe- 
cution of  mission,  and  the  pilot  work  load  associated  with  flying  must  not 
adversely  affect  his  ability  to  perform  other  tasks.  Again,  the  maneuverability, 
accuracy,  and  level  of  pilot  work  load  can  be  improved  by  means  of  active 
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control  technology.  At  the  present  time,  however,  the  practical  problems  of 
applying  the  technology  to  powered  lift  aircraft  are  not  well  understood.  In 
order  to  provide  the  required  data  base,  an  applications-oriented  program  has 
been  initiated  at  the  Ames  Research  Center.  The  objectives  of  this  program 
are  to  generate  design  guide  lines  and  to  provide  flight  test  confirmation  re- 
quired for  incorporation  of  active  control  technology  into  this  class  of  air- 
craft. The  present  paper  describes  the  progress  made  in  one  segment  of  this 
program,  namely,  the  development  of  a methodology  for  the  design  of  automatic 
trajectory  control  systems  for  powered  lift  aircraft. 


THE  AUGMENTOR  WING  RESEARCH  AIRCRAFT 

The  specific  case  being  used  in  the  development  and  tests  of  the  design 
methodology  is  the  Augmentor  Wing  Research  Aircraft.  The  aircraft  is  a 
de  Havllland  C-8A  "Buffalo"  modified  according  to  the  general  arrangement 
shown  in  figure  1.  The  aircraft  is  powered  by  two  turbofan  engines.  The 
relatively  cold  flow  from  the  front  fans  is  ducted  through  the  wing  and  fuse- 
lage to  the  augmented  jet  flap,  blown  ailerons,  and  fuselage  boundary  layer 
control  systems.  The  hot  gas  flows  through  two  pairs  of  nozzles  which  can  be 
rotated  in  flight  to  provide  vectoring  of  the  hot  thrust  through  a 98®  range. 

The  hot  and  cold  thrusts  are  nonlinear  functions  of  the  throttle  setting.  The 
nozzle  servos  move  the  nozzles  in  unison  in  response  to  a single  nozzle  angle 
command.  The  system  is  quite  fast,  being  limited  to  90  (°/sec.).  The  throttle- 
to-thrust  control  system  is  relatively  slow  with  a bandwidth  of  approximately 
1 (rad./sec.). 

The  cold  flow  has  a pronounced  effect  on  the  lift  and  drag  polars  of  the 
aircraft.  For  example,  figure  2 shows  the  wing-body  polars  for  two  flap 
settings.  The  independent  variables  in  the  plots  are  the  aircraft  angle  of 
attack,  a,  and  the  cold  thrust  coefficient  Cj  = Tj,/QS^,  where  the  cold  thrust 
Tc  is  a nonlinear  function  of  throttle,  and  density  and  temperature  of  the 
air;  Q is  the  dynamic  pressure,  and  is  the  wing  area.  Of  particular  signi- 
ficance for  the  design  of  flight  path  control  systems  is  the  large  variation 
in  the  basic  aerodynamic  characteristics  of  the  aircraft. 

Certainly,  there  is  a large  change  between  the  cruise  configuration 
(flap  = 4.5°)  and  the  landing  configuration  (flap  = 65°).  But  present  indica- 
tions are  that  the  nonlinearity  is  significant  even  over  a much  smaller  region. 
For  example,  figure  3 shows  the  total  lift  and  drag  coefficients.  Including 
the  effects  of  the  hot  thrust  for  the  case  of  constant  flap,  throttle  and 
speed  lyhich  corresponds  to  a typical  landing  configuration  with  angle  of  attack 
and  nozzle  angle  V in  the  active  control  mode.  Point  Ai  in  the  figure  repre- 
sents equilibrium  flight  along  the  -7.5°  glide  slope.  Point  A2  represents 
level  flight.  Also  shown  are  the  derivatives  of  the  total  force  coefficient 
at  these  two  points.  As  the  aircraft  is  maneuvered  from  point  Ai  to  point  A2 
the  changes  in  these  derivatives  may  adversely  affect  closed  loop  dynamics. 

But  of  greater  concern  is  that  if  the  maneuver  is  performed  by  means  of  a 
feed-forward  command  based  on  the  linear  model  at  point  Ai,  then  the  aircraft 
will  be  out  of  trim  at  A2  by  ACl  /Cl  * 4.7%.  Because  of  bandwidth  limitations 
imposed  on  the  altitude  control  loop  ((%  ;5.  rad./sec.)  by  unsteady  aero- 

dynamics, the  error  in  trim  results  in  an  altitude  error  Ah  >6  ft.  Similarly, 
transition  from  A2  to  A^  will  end  up  at  A21;  the  corresponding  error  Ah  > 16  ft. 
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Of  course  this  hangoff  error  can  be  removed  by  means  of  an  integrator,  but  the 
removal  will  be  too  slow  for  many  maneuvers.  Consequently,  the  transition  be- 
tween and  A2  must  be  considered  to  be  nonlinear. 

The  design  problem  is  further  complicated  by  the  presence  of  redundant 
controls.  Thus,  the  two-dimensional  total  force  coefficient  G = (Cd,Gl)^  is  a 
function,  say  C(F,T,a,v),  of  four  variables,  namely  flap,  throttle,  angle  of 
attack,  and  nozzle  angle.  For  example,  figure  4 shows  the  plot  of  C(F,T,a,v) 

= Co,  where  Cq  corresponds  to  steady  flight  along  -7.5®  glide  slope.  It  may 
be  noted  that  the  plot  is  rather  nonlinear.  The  problem  is  to  be  able  to 
generate  online  optimum  trim  values  of  the  controls  (F,T,a,v)  for  any  admis- 
sible trim  values  of  (Cd>Cl). 


DESIGN  APPROACH 

The  approach  is  motivated  by  the  following  line  of  reasoning.  Let 
equation  (1)  be  the  system  state  equation. 

X = f (x,u)  (1) 

The  control  u is  restricted  to  a set  U which  may  depend  on  the  state  x.  A 
trajectory  (xo(t),  t e T)  is  flyable  if  for  all  t e T,  there  is  a control 
Uo(t)  such  that 

Xo(t)  = f (xo(t),Uo(tj)  (2) 

The  trita  problem  is  to  find  a control  Ug  satisfying  (2),  given  that  the  trim 
trajectory  is  flyable.  The  solution  will  be  an  inverse  of  (1),  namely  a func- 
tion (g,F),  which  we  call  the  trimmap,  such  that  for  all  (ic,x)  e F, 

£ 

f (x,g(ii:,x))  = X (3) 

The  corresponding  trim  control  is  given  by 

“0=  g(^o>^o) 

Usually,  trim  refers  to  cases  with  constant  Here  may  vary  with  time. 

Note  that  when  the  controls  are  redundant,  state  equation  (1)  alone  is  not 
enough  to  define  the  trimmap  (g,F),  and  additional  conditions  must  be  intro- 
duced to  resolve  the  redundancy. 

The  trim  problem  may  be  difficult  to  solve;  but,  evidently,  its  solution 
to  required  accuracy  is  the  essential  first  step  in  the  design  of  automatic 
flight  path  control  systems.  The  next  step  usually  taken  is  to  design  a con- 
trol system  based  on  perturbation  models.  Thus,  given  a flyable  nominal  tra- 
jectory (Xq,Xq)  £ F trimmed  by  u^  according  to  equation  (4),  the  linear  model 
(5)  is  obtained  for  the  perturbations  6x  = x - and  6u  = u - Uq. 

6x  = f dx  4-  f 6u  (5) 

X u 
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Then,  the  application  of  the  methods  of  linear  control  theory  yields  the 
perturbation  control  law  (6) . 

6u  = K<Sx  (6) 

Since  the  coefficients  in  (5)  depend  on  the  nominal  trajectory,  the  process 
must  be  repeated  for  sufficiently  large  number  of  nominal  trajectories 
(xojXq)  e F until  F is  adequately  covered.  The  result  is  a scheduled  gain 
matrix  K(Xq,Xq),  and  the  complete  control  law  is 

u = g(Xo,Xo>  + K(xo,Xo)(x  - Xq)  (7) 

The  major  drawback  of  this  approach  is  that  when  the  state  equation  (1) 
is  highly  nonlinear,  the  procedure  for  choosing  the  proper  set  of  nominal  tra- 
jectories to  cover  the  flight  envelope  F is,  at  present,  rather  unclear.  For 
this  reason  we  at  Ames  have  decided  to  investigate  a different  approach. 

Consider  the  trim  equation  (4),  Suppose  that  initially  x = Xq.  Then  in 
the  absence  of  modeling  errors  the  control  Uq  will  maintain  x = Xq . The 
tracking  will  be  perfect  even  if  at  some  point  the  acceleration  of  the  nominal 
trajectory  is  perturbed  from  Xq  to  Xq  + (Sxq,  provided  that  (xq  + <Sxo,  x)e  F. 
The  corresponding  control  is 

u = g(X(3  + 6xq,x)  (8) 

Now,  suppose  that  initially  x - Xq  = 6x  4 0,  but  that  the  error  can  be  removed 
by  means  of  a flyable  trajectory.  Then  there  is  a perturbed  nominal  acceler- 
ation Xq  + <Sxq  which  will  take  x into  Xq  by  means  of  the  control  law  (8) . 

That  is,  the  feedback  for  the  control  of  process  uncertainties  can  be  closed 
through  the  trimmap  as  in  equation  (8),  rather  than  after  the  trimmap  as  in 
equation  (7).  Such  control  by  means  of  continual  adjustments  in  commanded 
acceleration  forms  the  basis  of  the  Ames  approach.  The  emphasis  is  shifted 
from  perturbation  models  on  F to  flyable  perturbations  in  commanded  accelera- 
tion. The  next  section  describes  the  resulting  structure  of  the  control 
system. 


FULL  FLIGHT  ENVELOPE  AUTOPILOT 

The  proposed  structure  of  the  autopilot  is  shown  in  figure  5.  The  plant 
represents  the  basic  aircraft  together  with  attitude  and  throttle  servosystems, 
and  sensors.  Everything  to  the  left  is  the  autopilot.  It  consists  of  four 
blocks  - trimmap,  wind  filter,  compensator,  and  command  generator  - which 
carry  out  the  following  functions. 

Trimmap  computes  the  active  control  uc  to  generate  acceleration  with  in- 
ertial coordinates  Vsi.  For  the  case  shown,  the  active  controls  are  the  com- 
manded attitude  and  nozzle  angle;  while  the  redundant  controls  are  the  throttle 
and  flap.  Any  other  partition  of  the  controls  is  treated  similarly.  The  total 
commanded  aerodynamic  force  Fsc  is  transformed  into  estimated  stability  coor- 
dinates Fvc  from  which  commanded  roll  4*v>  angle  of  attack  sideslip  angle  3c » 


926 


and  nozzle  angle  are  computed  online  using  the  nonlinear  inverse  function  g. 
The  commanded  attitude  direction  cosine  matrix  is  given  by 

■=  E2(a_,)E5(6^)Ej(4,^)E2(Y^)E3»^)  (9) 

The  attitude  control  system  (servo)  may  operate  directly  on  Acs*  case 
Euler  angles  are  required,  they  are  given  by  Acs  ® Ei(^c)E2(9c)E3(i{'c)*  any 
case,  commanded  attitude  and  nozzle  are  defined. 

Wind  filter  computes  smoothed  inertial  coordinates  v|  of  aircraft  velo- 
city relative  to  the  airmass  from  body  mounted  air  velocity  sensors,  and  iner- 
tial velocity  and  attitude  of  the  aircraft.  The  relative  velocity  is  needed 
in  the  trimmap  to  locate  stability  axes  and  to  convert  forces  into  coefficients. 
Note  that  only  inertial  coordinates  of  wind  are  filtered.  The  aircraft  velocity 
is  unaffected.  Hence,  in  the  absence  of  sensor  errors  and  wind,  v|  = Vg. 

Trimmap,  wind  filter,  and  attitude  and  throttle  control  systems  form  an 
acceleration  controller.  The  input  is  ^si»  output  is  the  actual  accelera- 
tion ’^g  of  the  aircraft.  Moreover, 

Vs  = Vgi  + e (10) 

where  the  error  e depends  on  the  inaccuracies  of  inversion  g and  wind  esti- 
mates, the  presence  of  unsteady  aerod3mamlcs  in  f such  as  alpha  dot  effects, 
and  on  the  attitude  and  throttle  servo  d3mamics.  It  is  the  purpose  of  the 
compensator  to  generate  corrective  accelerations  Vsm  to  compensate  for  the 
error  e of  the  acceleration  controller.  Inertial  coordinates  of  position, 
velocity,  and  acceleration  are  transformed  into  approximately  longitudinal, 
lateral,  and  normal  errors  by  means  of  the  direction  cosine  matrix  Ayj,  compu- 
ted from  the  commanded  inertial  velocity  VscJ  the  errors  are  weighted  by  con- 
stant gain  matrices  K]^,  K2,  and  K3  commensurate  with  the  acceleration  capa- 
cities of  the  aircraft  in  these  directions,  and  the  result  is  filtered  to  in- 
sure compatibility  with  attitude  and  throttle  servo  dynamics.  The  corrective 
acceleration  is  transformed  back  into  inertial  space  and  added  to  the  command 
Vsc  bo  give  the  input  Vsl.  In  this  way,  the  feedback  is  closed  around  the 
process  uncertainties  e so  that  the  representation 

Vs  = Vgc  (11) 

is  sufficiently  accurate  provided  that  Vsc  is  admissible,  namely  (Vsc»Vs)  is 
flyable  and  the  bandwidth  of  Vsc  is  suitable  restricted. 

The  last  major  block  of  the  autopilot  is  the  command  generator.  Its 
purpose  is  to  porvide  only  admissible  commands  to  the  acceleration  controller. 
One  of  the  subblocks  defines  the  autopilot  mode.  For  the  case  shown  in  the 
diagram,  27  modes  are  available.  Every  mode  defines  whether  position,  velo- 
city or  acceleration  is  to  be  tracked  in  each  of  the  three  axes.  Thus,  mode 
(0,0,0)  requests  three  axis  acceleration  tracking;  mode  (1,1,1)  requests  three 
axis  velocity  tracking;  etc.  As  an  example  of  the  use  of  modes  suppose  that 
the  autopilot  is  in  mode  (2,2,2)  tracking  position  of  a 4-D  trajectory  com- 
manded by  the  air  traffic  control  (ATC)  as  the  aircraft  penetrates  a heavy, 
localized  turbulence.  The  mode  may  have  to  be  changed  to,  say,  (1,1,1)  or 
possibly  even  (0,0,0).  On  exiting  the  turbulence,  the  mode  may  be  returned 
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back  to  (2,2,2).  The  command  generator  must  generate  an  admissible  trajectory 
for  bringing  the  aircraft  back  on  the  trajectory  commanded  by  the  ATC. 

The  ATC  trajectory  may  be  transmitted  continuously  to  the  aircraft,  or 
more  likely,  it  may  be  generated  onboard  from  a given  set  of  trajectory  para- 
meters. The  latter  may  be  transmitted  by  the  ATC  or  selected  by  the  pilot. 

In  any  case,  if  the  commanded  trajectory  (Rscj^scj^sc)  is  discontinuous  in 
any  of  the  variables  (e.g.  "step  down  altitude  by  500  feet"  or  "change  glide 
path  from  -7.5°  to  -2°",),  the  command  generator  must  generate  the  required 
flare  maneuver. 

Such  flare  maneuvers  are  generated  by  means  of  transition  dynamics.  This 
subblock  consists  of  a stable  state  equation,  initial  conditions,  and  an  out- 
put map.  At  the  time  of  the  initiation  of  the  transition  dynamics, 
(Rsc>Vsc»^sc)  = (Rs»Vs,'^s)*  At  the  end  of  the  transient,  (Rsc»Vsc»^sc)  ® 
(R|c»Vsc»’5'sc)  • The  dynamics  of  the  transient  are  made  compatible  with  the 
acceleration  controller  by  a proper  selection  of  the  state  equation.  To  en- 
sure continuity  in  position,  velocity,  and  acceleration,  the  state  equation 
must  be  at  least  three-dimensional  (and  three-axis) . In  the  diagram,  a linear 
state  equation  is  shown.  Nonlinear  transition  dynamics  are  currently  being 
designed  to  permit  arbitrarily  large  initial  deviations  from  the  ATC  command. 

The  feasibility  of  the  autopilot  has  been  tested  by  application  to  the 
unmodified  C8A  and  the  Augmentor  Wing  Research  Aircraft  for  which  detailed 
simulations  are  available  at  Ames.  Eresent  Indications  are  that  the  proposed 
structure  is  feasible,  although  final  evaluation  must  await  flight  tests 
which  are  scheduled  in  1976. 

The  present  paper  presented  an  overview  of  the  proposed  design  methodo- 
logy. Several  reports,  currently  in  preparation  and  soon  to  appear,  discuss 
the  methodology  in  greater  detail. 


CONCLUSION 

The  proposed  design  approach  has  several  advantages,  among  which  are  the 
following. 

(1)  The  approach  is  applicable  to  a large  class  of  aircraft  with 
nonlinear  dynamics. 

(2)  The  approach  is  nearly  algorithmic, 

(3)  The  approach  is  invariant  for  a wide  spectrum  of  tracking  accuracy 
requirements . 

(4)  There  is  an  effective  trade-off  between  tracking  accuracy  require- 
ments and  computer  requirements  and  a priori  knowledge  of  system 
dynamics. 

Present  indications  are  that  the  proposed  design  methodology  is  feasible,  but 
definite  evaluation  must  await  flight  tests. 
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Figure  1.  Modified  C-8A,  General  Arrangement 


Figure  2.  Typical  Wing-Body  Polar s of  the  Augmentor  Wing 
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ACTIVE  CONTROL  SYSTEM  TRENDS 

Eugene  E,  Yore  and  Dale  C.  Gunderson 
Honeywell  Incorporated 


ABSTRAGX 

The  Active  Control  Concepts  which  achieve  the  benefit  of  improved  mission 
performance  and  lower  cost  generate  the  system  trends.  The  system  trends  are 
towards  improved  dynamic  performance,  more  integration  and  digital  fly-by-wire 
mechanization.  These  system  trends  yield  new  analytical  issues  and  implementa- 
tion requirements: 

, Higher  bandwidth,  more  dynamic  coupling,  stochastic  and 
deterministic  inputs. 

. Limited  control  power. 

. Multiple  control  loops,  more  interaction,  multiple  and  conflicting 
criteria. 

. Reliability  (saf ety-of-flight  requirements)  and  low  cost. 

New  tools  and  approaches  have  been  or  are  being  developed  to  address  the  new 
analytical  and  implementation  issues: 

. Quadratic  Optimal  Control  . Large  Scale  Integration 

. Multiloop  Frequency  Response  . Microprocessor  technology 

, Digital  System  Analysis  , Digital  Architecture 

. Software  technology 


INTRODUCTION 

Active  control  system  trends  are  towards  improved  performance,  more 
integration  and  digital  fly-by-wire  mechanization.  Most  active  control 
concepts  are  well  known  and  will  be  briefly  noted.  The  benefits  are  better 
mission  performance  and  lower  cost.  The  active  control  concepts  and  benefits 
determine  the  system  trends. 

The  new  analytical  issues  result  from  the  active  control  system  trends. 

An  active  control  system  has  a first  order  effect  on  aircraft  performance. 

More  aircraft  and  controller  configurations  must  be  analyzed.  The  control 
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design  problem  is  larger  and  more  complex.  The  designer  must  consider  higher 
bandwidths^  more  dynamic  coupling,  stochastic  and  deterministic  disturbances 
and  commands  and  limited  control  power.  Simultaneous  implementation  of  some 
active  control  concepts  yields  design  problems  with  multiple  sensors,  multiple 
responses  and  multiple  control  loops  with  multiple  and  conflicting  criteria. 

New  tools  are  needed  to  address  these  analytical  issues.  Better  aircraft 
mathematical  models  are  required.  Other  tools  are  classical  and  modern 
controller  synthesis  and  analysis  approaches  (quadratic  optimal  control,  multi- 
variable frequency  response  and  digital  systems  analysis). 

New  implementation  needs  also  result  from  the  active  control  System  trends. 
The  designer  is  confronted  with  safety-of-f light  control  system  requirements. 
Control  system  cost  becomes  a crucial  factor  in  achieving  control  configured 
vehicle  cost  benefit. 

New  approaches  to  meet  the  implementation  requirements  are  digital 
mechanization,  advances  in  architecture  to  use  microprocessors  and  to  achieve 
fault  tolerance,  large  scale  integration  and  software  technology. 

These  topics  will  be  discussed  in  subsequent  sections: 

. Active  control  concepts  and  benefits 

. Control  systems  trends 

. Analytical  issues 

. Analytical  tools 

. Implementation  needs 

Implementation  technology  trends. 

ACTIVE  CONTROL  CONCEPTS  AND  BENEFITS 

Active  control  concepts  are  well  known  and  have  been  studied  either  on 
paper  or  by  flight  test  on  several  airplanes: 

. Relaxed  static  stability  (e.g.  C-5A,  F-8,  F-I6,  JA-37) 

. Ride  Smoothing  (XB-7O,  B-52,  B-1,  C-5A,  YF-12,  JA-37) 

, Flight  envelope  limiting  (F-101,  F-104,  F-8) 

. Maneuver  load  relief  (C-5A,  B-52) 

. Gust  load  relief  (C-5A,  B-52,  YF-12) 
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Structure  mode  damping  (B-52,  C-5A,  YF-12) 

. Flutter  mode  damping  (B-52,  YF-12) 

. Flight  path  and  attitude  coupling  (B-52  direct  lift  control,  G-5A, 
Advanced  Fighter  Technology  Integration  Program,  C-I3O  gunship). 

Other  concepts  which  are  related  to  the  propulsion  system  can  be  included 
in  a list  of  active  control  concepts. 

. Propulsion  integration  (TF-30  and  Joint  Technology  Demonstrator  Program) 

. Flight  Propulsion  Coupling  (YF-12  and  Flight  Propulsion  Control  Coupling 
Program) 

A rather  extensive  data  base  is  evolving  for  these  concepts  [l  - 

The  benefit  of  active  control  is  improved  mission  performance  (payoff) 
and  reduced  cost.  The  measure  of  performance  is  dependent  on  the  particular 

aircraft's  mission.  It  could  include  payload  and  range  in  a transport  type 
aircraft  and  flight  envelope  and  maneuverability  in  a fighter  aircraft.  The 
cost  is  total  system  life  cost  in  dollars.  The  goal  is  to  maximise  the  ratio 
payoff  to  cost. 


ACTIVE  CONTROL  SYSTEM  TRENI^ 

Active  control  system  trends  fall  into  three  cateogires: 

. Performance 
. Integration 
. Mechanization 

Improving  system  performance  increases  the  difficulty  of  the  design 
problem  and  can  affect  the  implementation  cost.  The  designer  must  consider 
wider  bandwidths  and  more  dynamic  coupling  like  in  structural  and  flutter  mode 
suppression  and  ride  quality  control.  He  must  design  control  systems  for 
both  stochastic  and  deterministic  commands  and  disturbances  like  maneuver  and 
gust  load  control.  When  we  push  control  configured  vehicle  concepts  to  the 
limit  the  designer  is  generally  faced  with  limited  control  power.  This  can 
generate  a requirement  for  flight  envelope  limiting  or  be  a design  constraint 
during  flight  envelope  limiting. 

Integration  is  required  to  implement  more  than  one  CCV  concept  along  with 
conventional  autopilots  and  control  and  stability  augmentation  systems.  It  is 
also  a result  of  trying  to  improve  performance  by  implementing  favourable 
coupling.  Control  system  or  mode  integration  presents  the  designer  with 
multiple  sensors,  multiple  responses  and  multiple  control  loops  with  more  inter- 
action between  variables.  It  can  also  present  the  designer  with  a multiple  and 
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conflicting  criteria.  Examples  of  the  integration  trend  are  the  B-52  CGV 
program,  the  YF-12  Cooperative  Autopilot  Propulsion  Control  System  program  and 
the  TF“30  Integrated  Propulsion  Control  System  program. 

The  system  mechanization  trends  are  towards  safety-of-flight  requirements 
and  fly-by-wire  mechanization.  Safety-of-flight  requirements  come  from  the 
performance  requirements  of  some  CCV  concepts  like  relaxed  static  stability. 
TheSR-71  is  a specific  exan^le.  Safety-of-flight  will  be  a requirement  if 
future  aircraft  are  designed  to  rely  on  stress  relief  or  mode  stabilization 
for  structure  integrity.  Fly-by-wire  mechanizations  reduce  cost  and' improve 
performance.  Fly-by-wire  has  been  demonstrated  on  the  F-4,  F-8  and  C-141. 

The  mechanization  trends  are  towards  digital  implementation.  This  is 
caused  by  the  cost  projections  of  digital  hardware.  Production  digital  hard- 
ware is  here  today  on  the  JA-37  digital  flight  control,  It  is  coming  soon  on 
the  Space  Shuttle  digital  flight  control  and  main  engine  control,  and  the 
Integrated  Propulsion  Control  System  Program.  Cost  is  the  primary  factor  in 
the  digital  versus  analog  tradeoff. 

ACTIVE  CONTROL  ANALYTICAL  ISSUES 

The  analytical  issues  resulting  from  the  systems  trends  and  active  control 
concepts  pose  a more  difficult  design  and  specification  problem  for  the  buyer 
and  supplier.  Active  control  system  directly  affect  aircraft  performance. 

The  control  design  engineer  is  also  confronted  with; 

. higher  bandwidths 

. coupled  dynamics 

. stochastic  and  deterministic  commands  and  disturbances 
. limited  control  power 
multiple  variables 
. multiple  and  conflicting  criteria 
. increased  interaction 
. digital  specifications 
. extensive  system  tradeoffs. 

The  origin  of  most  of  these  issues  was  discussed  in  the  previous  section. 

Two  additional  issues  are  digital  specifications  and  extensive  system 
tradeoffs.  When  digital  mechanization  is  a candidate  it  is  necessary  to 
select  and  specify  digital  variables: 
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. sample  rate  and  multiple  sample  rates 
. wordlength  and  multiple  wordlength 

. eomputational  delay  and  multiple  computational  delay. 

This  is  a new  analysis  and  design  problem.  Extensive  tradeoffs  between 
active  control  and  aircraft  concepts  and  configurations  are  necessary  to 
optimize  the  benefit.  Both  aircraft  and  controller  design  and  analysis  speeds 
and  cost  are  the  issue. 


AmLYTICAL  METHODS 

In  order  to  achieve  the  potential  benefits  of  active  control  technology 
we  usually  require  accurate  and  relatively  complete  descriptions  of  the  air- 
craft dynamics.  More  design  iterations  of  these  sophisticated  configurations 
are  usually  required.  - 

NASA  and  the  Air  Force  are  funding  significant  efforts  to  develop  computer 
programs  to  generate  the  aerodynamic  and  structural  models  from  the  standpoint 
of  the  control  system  designers  needs  and  also  to  develop  the  programs  necessary 
to  rapidly  synthesize  and  analyze  active  control  configurations. 

In  addition,  technology  can  be  developed  which  will  make  the  control 
system  relaftively  insensitive  to  modeling  deficiencies  and  errors.  This  is 
important ^f or  both  reliability  and  performance  reasons. 

lyfodern  control  technology  modulation  to  the  well  developed  classical 
techniques  presently  exist  to  aid  the  designer.  These  are  in  the  areas  of 
Optimal  Control^  Digital  Control  and  Multiple  Input/Output  Control. 

OPTIMAL  CONTROL.  Quadratic  optimal  control  synthesis  techniques  makes  it 
relatively  easy  to  handle; 

. multiple  control  inputs 
. multiple  sensor  outputs 
. multiple  responses 
. multiple  criteria 

. stochastic  and  deterministic  commands  and  disturbances 
. digital  and  analog  mechanizations 
. constant  or  time  varying  dynamics 
. short  and  long  mission  segments. 

These  features  were  recognized  back  in  the  early  sixties.  Since  then  over  30 
man-years  of  development  have  gone  into  making  the  quadratic  optimal  methodol- 
ogy a practical  design  tool  at  Honeywell  [9-I2],  probably  many  times  that 
effort  have  been  carried  on  throughout  the  United  States.  These  developments 
of  the  quadratic  design  methodology  have  been  directed  towards: 
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. lowering  the  design  cost 
. improving  control  system  performance 
. constraining  the  designs  to  simpler  hardware 
. automated  modeling 

. consideration  of  the  data  and  model  uncertainties. 

Today  the  quadratic  design  methodology  for  controller  synthesis  is  a design 
and  analysis  software  package.  It  can  be  used  to: 

. configure  control  systems 
. compute  control  laws 
. evaluate  control  system  performance 

. perform  extremely  rapid  tradeoffs  between  competing  configurations 
and  control  laws. 

The  ultimate  benefits  of  this  design  tool  are: 

. mission  oriented  performance 
. lower  design  cost 

. better  performance  or  cheaper  hardware 
. controller  designs  for  complex  systems. 

MULTIVARIABLE  FREQUENCY  DOMAIN.  It  is  necessary  to  take  a new  look  at  the 
stability  criteria  when  systems  or  CCV  concepts  are  integrated  and  multiple 
control  loop  designs  are  implemented.  Vector  frequency  response  or  multiple 
variable  frequency  response  is  a generalization  of  classical  gain  and  phase 
stability  margins.  It  is  valid  and  meaningful  for  multiple  loop  systems 
[13-16].  This  concept  can  be  used  to  write  specifications  for  integrated  or 
covp  led  systems.  It  can  also  be  used  in  the  design  process  to  achieve  the 
specification  or  improve  the  design. 

DIGITAL  CONTROL.  Digital  implementation  confronts  the  designer  with  a new 
problem  - specifying  digital  variables.  In  the  past,  the  analyst  has  designed 
control  laws  to  meet  performance  specifications,  the  systems  engineer  has  put 
together  control  modes  and  switching  and  the  circuit  engineer  has  designed  the 
hardware.  Interaction  between  these  three  functions  was  minimal.  In  a 
digital  implementation  the  analysts  control  law  performance  is  dependent  on 
hardware  variables  (wordlength  and  computer  speed)  and  system  or  software 
variables  (sample  rate  and  computational  delay). 

Designing  digital  control  laws  can  be  accomplished  several  ways : 

. digitize  analog  design 

direct  digital  design  (classical  or  optimal) 
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No  matter  what  technique  is  used  the  issue  remaining  is  what  values  of  the 
digital  variables  are  acceptable.  The  digital  variables  can  be  specified 
by  digital  analysis  software.  This  software  must  compute  performance  and 
stability  measures  as  a function  of  the  digital  system  variables , i.e.,  sample 
rate,  wordlength,  computational  delay  or  multiple  values  of  these  variables. 
The  performance  and  stability  measures  include  such  things  as  pole  and  zero 
locations,  gain  and  phase  margins,  rms  and  discrete  responses  and  frequency 
response.  Rapid  analysis  by  tijis  software  can  yield  precise  specifications 

[17J. 


Digital  control  also  yields  new  capability  like  nonlinear  control,  adaptive 
control,  long  memory  and  tight  tolerances.  These  new  capabilities  to  date 
are  largely  unexploited. 


IMPLEMENTATION  NEEDS 

The  implementation  needs  that  result  from  the  active  control  system  trends 
are  increased  system  reliability,  lower  cost,  and  size  and  weight  improvements: 

. Increased  system  reliability  - The  safety  -of  flight  requirements 
of  active  controllers  demand  improvements  in  system  reliability. 

This  can  be  achieved  through  a combination  of  improved  component 
reliability  and  through  extensive  and  effective  redundancy  to  achieve 
fault  tolerance, 

. Reduced  cost  - In  order  to  realize  the  predicted  improvements  in 

performance  it  is  important  that  implementation  costs  do  not  increase. 
Since  the  computational  function  required  for  active  controllers  are 
increased,  the  implementation  cost  per  function  must  decrease. 

. Size  and  weight  improvements  - Again  the  performance  gains  predicted 
through  the  use  of  active  controllers  can  be  maximized  if  the 
implementation  size  and  weight  of  the  controller  can  be  reduced. 

IMPLEMENTATION  TECHNOLOGY  TRENDS 

There  are  a number  of  current  developments  and  trends  in  digital  system 
implementation  technology  that  will  contribute  to  satisfying  the  implementation 
needs  discussed  in  the  previous  section.  These  trends  and  their  anticipated 
impact  are  discussed  below.  This  section  deals  exlclusively  with  digital 
implementation  technology  since  that  is  where  the  most  significant  gains  can 
be  expected. 

LARGE  SCALE  INTEGRATED  CIRCUITS,  The  availability  of  large  scale  integrated 
(LSI)  circuits,  in  which  hundreds  of  logic  functions  are  implemented  on  a single 
chip,  is  allowing  implementation  of  digital  systems  with  improvements  in  both 
cost  and  reliability. 
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The  major  impact  will  be  from  standard  (off  the  shelf)  LSI  which  will  be 
available  in  increasingly  complex  functional  building  blocks.  In  1978>  sH  of 
these  will  satisfy  commercial  specs,  25  percent  will  satisfy  extended  thermal 
specs,  and  9 percent  will  satisfy  mil  specs.  Some  of  these  building  blocks 
are ; 


. Memory  modules  - RAM’s  (Random  Access  Memories),  ROM’s  (Read  Only 

Memories),  and  EAROM’s  (Electrically  Alterable  ROM’s)  will  be  available 
at  lower  cost  as  the  number  of  bits  per  chip  increases.  This  not  only 
impacts  cost  directly  but  it  also  allows  more  modular  architecture 
to  be  used  since  small  memories  are  economical. 

. Programmable  Logic  Arrays  - These  are  complex  functional  building 
blocks  that  are  programmable  to  allow  performance  of  a number  of 
different  logic  functions. 

. Microprocessors  - LSI  is  making  it  possible  to  implement  microcomputers 
at  extremely  low  cost.  More  on  microprocessor  trends  and  their  impact 
are  discussed  later  in  this  section. 

Custom  LSI  will  also  be  available.  In  those  cases  where  the  function 
cannot  be  conveniently  implemented  with  standard  LSI,  custom  LSI  can  be 
justified  for  surprising  low  volumes.  In  reference  18  it  is  shown  that  for  a 
volume  of  less  than  100  systems,  (the  sample  system  consisted  of  5OO  gates  of 
random  logic)  it  is  cost  effective  now  to  use  custom  LSI  as  compared  to  standard 
Small  Scale  Integration/Mediura  Scale  Integration  (SSI/mSI)  implementation. 

At  a volume  of  1000  systems,  the  cost  advantage  (including  both  recurring  and 
non-recurring  costs)  is  nearly  an  order  of  magnitude. 

LSI,  either  standard  or  custom,  or  a combination  of  the  two  will  provide 
major  cost  advantages  now  and  increasingly  so  in  the  future. 

The  use  of  LSI  implementation  also  provides  advantages  in  terms  of 
reliability,  primarily  because  of  a reduction  both  in  the  number  of  ICs  and  in 
the  number  of  interconnects  in  the  system.  Reference  I8  shows  that  in  a 
typical  digital  subsystem  of  50O  gates  of  random  logic,  an  order  of  magnitude 
reliability  improvement  can  be  realized  with  LSI  implementation  as  compared  to 
SSI/mSI  implementation. 

LSI  implementation  will  also  provide  significant  improvements  in  size  and 
Weight  compared  to  the  standard  SSI/mSI  implementation.  The  sample  system  of 
Reference  18  shows  more  than  order  of  magnitude  improvement. 

MICROPROCESSOR  TECHNOLOGY.  The  LSI  technology  has  spawned  a significant  new 
technology  called  microprocessors.  The  microprocessor  is  defined  as  a 
standard  programmable  I5I  which  consists  of  a parallel  arithmetic  unit,  a 
control  unit,  and  a general  purpose  parallel  data  bus  for  memory  and  external 
device  communications.  This  chip  (or  chip  set)  can  be  combined  with  LSI 
memory  chips  to  realize  a general  purpose  microcomputer  for  extremely  low  cost. 
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These  microprocessors  (commercial  spec)  are  now  being  manufactured  in  high 
volume  by  semiconductor  vendors.  It  is  projected  that  by  1978>  200K  instruc- 
tion per  second  microprocessor  chips  (or  chip  sets)  can  be  purchased  fox  from 
II5  to  $25  each  in  volumes  of  100  or  more*  Thus  8 bit  and  I6  bit  micro- 
computers can  be  implemented  for  as  little  as  $200  to  |400.  While  extended 
spec  and  mil  spec  microprocessors  will  undoubtedly  cost  more,  they  will  be 
available. 

These  njierocomputers,  having  the  programnability  of  conventional  general 
purpose  computers,  will  be  used  in  two  ways: 

. to  perform  computational  functions 

. to  replace  hard-wired  logic 

In  both  applications  a significant  fact  is  that  there  is  no  longer  a driving 
force  to  use  the  device  efficiently.  System  level  cost  trade-offs  tend  to 
lead  to  dedicated  use  of  these  devices  for  certain  functions  even  though  this 
may  result  in,  for  example,  the  device  being  kept  busy  only  20  percent  of  the 
time.  This  leads  to  important  new  trade-offs  in  the  area  of  system  architecture, 
which  is  discussed  next, 

ARCHITECTURE,  By  system  architecture  we  mean  the  overall  organization  or 
configuration  of  the  building  blocks  of  the  system.  The  significant  trend 
here  that  will  help  satisfy  the  implementation  needs  of  advanced  flight  control 
systems  is  a trend  towards  more  distributed  systems.  From  a digital  computer 
point  of  view,  this  means  networks  of  minicomputers  or  microcomputers  rather 
than  the  uni-processor  architecture.  The  low  cost  of  the  computer  modules  will 
lead  to  dedication  of  a computer  module  to  a specific  function  rather  than  time- 
sharing or  multi-programming  to  allow  a computer  module  to  handle  several 
functions.  This  is  done  primarily  to  reduce  software  costs,  particularly  the 
executive  program. 

Extensive  research  and  advanced  development  activity  is  going  on  now  on 
distributed  computer  systems  with  emphasis  on  bussing  techniques  and  executive 
techniques  Cl93.  The  distributed  computer  approach  has  the  following  potential 
payoffs: 


. Cost  - Since  there  is  only  one  computer  building  block  in  the  system. 

. Expandability  - Since  the  bussing  and  executive  will  allow  a variable 
number  of  computer  modules  to  be  present. 

. Fault  tolerance  - Techniques  are  needed  to  provide  backup  if  a module 
performing  a critical  function  should  fail.  J&ich  more  work  is 
required  in  this  area  but  since  all  computer  modules  are  identical, 
it  holds  promise  of  being  able  to  satisfy  fault  tolerance  requirements 
without  high  levels  of  redundancy.  The  use  of  the  small  dedicated 
building  block  allows  redundancy  to  be  applied  to  varying  degrees 
throughout  the  system  depending  on  the  criticality  of  the  function  being 
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performed.  The  interconnection  mechanism  is  a critical  resource  in 
this  system  so  special  purpose  hardware  for  fault  tolerance  may  be 
required  for  it. 

SOFTWARE.  A trend  towards  using  a library  of  software  modules  which  can  be 
tailored  and  linked  to  fit  the  software  requirements  of  a specific  system  will 
have  important  impacts  on  both  system  cost  and  reliability.  This  is  a 
significant  change  from  current  avionics  software  practice  in  which  ad  hoc 
techniques  are  used  on  a system  by  system  basis,  producing  software  that  is 
both  expensive  and  unique.  Being  able  to  select  and  tailor  already  validated 
modules  to  satisfy  a new  requirement  also  contributes  to  reliability  because 
validation  and  verification  of  the  software  will  tend  to  be  more  complete. 

A trend  towards  the  use  of  higher  order  languages  is  an  important 
companion  of  the  library  of  modules  trend  in  order  for  the  library  to  be  trans 
ferable  from  one  computer  to  another. 

SUMMARY.  The  implementation  needs  of  higher  reliability  and  reduced  costs 
appear  to  be  achievable  due  to  the  following  implementation  technology  trends: 

. Large  Scale  Integrated  Circuits  can  provide  today  order  of  magnitude 
advantages  in  cost,  reliability,  and  size  and  weight  compared  to 
standard  SSI  implementations. 

. Microprocessors  are  rapidly  becoming  available  at  extremely  low  costs. 
It  is  projected  that  200K  instruction  per  second  microprocessor  chip 
sets  satisfying  commercial  specs  will  be  available  at  |15  to  $25  each. 

. Distributed  computer  architecture  consisting  of  a variable  number  of 
identical  computer  modules  interconnected  by  busses  are  being  developed 
These  architectures  have  potential  advantages  in  hardware  costs  and  in 
satisfying  fault  tolerance  requirements. 

. Software  trends  towards  re-use  of  software  through  use  of  a library 
of  modules  will  pay  off  in  terms  of  both  cost  and  reliability. 
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THE  IMPLEMENTATION  OF  FAIL-OPERATIVE  FUNCTIONS  IN 
INTEGRATED  DIGITAL  AVIONICS  SYSTEMS 


Stephen  S . Osder 
Sperry  Flight  Systems  Division 


SUMMARY 


System  architectures  which  incorporate  fail-operative  flight  guidance 
functions  within  a total  integrated  avionics  complex  are  described.  It  is 
shown  that  the  mixture  of  flight  critical  and  non-flight  critical  functions 
within  a common  computer  complex  is  an  efficient  solution  to  the  integration 
of  navigation,  guidance,  flight  control,  display  and  flight  management.  Inter 
facing  subsystems  retain  autonomous  capability  to  avoid  vulnerability  to  total 
avionics  system  shutdown  as  a result  of  only  a few  failures. 


INTRODUCTION 


The  advent  of  the  airborne  digital  computer  in  an  attractive  practical 
configuration  (from  the  standpoint  of  cost,  size  and  power)  has  set  the  stage 
for  the  emergence  of  a variety  of  new  avionics  system  architectures.  Despite 
the  continuing  growth  in  requirements  for  navigation,  guldsnce,  control  and 
data  management  functions,  the  Industry  is  faced  with  relentless  pressures  to 
hold  system  costs  to  pre-1970  levels.  We  require  increased  system  sophistica- 
tion, but  cannot  afford  increased  cost  ot  increased  complexity  and  its  con- 
comitant reliability  penalty.  The  solutions  appear  in  new  avionics  architures 
that  feature  a high  level  of  Integration  and  consolidation  of  functions.  In- 
deed, the  trivial  answer  to  any  cost  trade-off  study  of  competing  avionics 
architectures  is  the  totally  Integrated  system  where  a single  central  computer 
(of  sufficient  speed)  performs  all  required  functions  so  that  the  cost  of 
functional  growth  is  measured  only  by  the  cost  of  the  memory  increment.  This 
solution  does  not  acknowledge  the  complicating  factors  of  flight  critical  fail- 
operative  requirements  and  the  related  problems  of  fault  isolation  and  redun- 
dnacy  management. 

The  usual  approach  to  defining  a system  architecture  that  must  provide 
some  fail-operative  functions  is  to  separate  subsystems  into  fail-operative 
and  non-fall-operative  categories.  In  this  paper  it  is  shown  that  this  type 
of  separation  does  not  result  in  the  most  efficient  mechanization  of  the  de- 
sired function.  An  alternative  Integrated  system  architecture  that  starts 
with  the  requirements  for  the  fail-operative  autoland  and  stabilization  and 
control  functions  is  described.  It  soon  becomes  apparent  that  the  majority  of 
information  interfaces  needed  for  these  fail-operative  functions  are  also  used 
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for  the  other  guidance,  navigation,  display  and  data  management  requirements. 
The  system  architecture  and  safety  techniques  used  to  mechanize  the  fall- 
operative  requirements  can  be  made  completely  compatible  with  the  generally 
accepted  methods  of  Implementing  the  non-flight  critical  functions. 

Expanding  from  the  fail-operative  flight  guidance  system,  additional  in- 
terfaces are  added  to  achieve  the  remaining  navigation,  control  and  display 
functions.  These  additional  functions  are  treated  differently  In  terms  of  In- 
terface hardware  and  software  mechanizations  because  the  rather  elaborate 
monitoring  and  fault  isolation  routines  for  fail-operative  performance  are  not 
required. 

The  vulnerability  of  such  integrated  systems  to  the  total  loss  of  avionics 
functions  with  only  two  failures,  such  as  the  loss  of  two  central  computers, 
must  be  avoided.  Consequently,  the  system  architecture  must  make  provision 
for  continued  although  degraded  operation  through  the  retention  of  autonomous 
capability  In  the  various  Interfacing  subsystems.  These  back-up  provisions 
generally  appear  as  residual  hardware  functions  in  contrast  to  the  software 
functions  which  are  provided  by  the  primary  or  central  integrated  mode  of 
operation. 

This  paper  presents  a brief  rationale  for  the  selection  of  a totally  in- 
tegrated avionics  architecture  over  two  other  competing  candidates.  The 
organization  of  the  totally  integrated  system  and  the  techniques  for  achieving 
fail-operative  performance  for  flight  critical  modes  are  described.  The  vul- 
nerability to  total  system  shutdown  is  analyzed,  and  methods  of  protecting 
against  that  vulnerability  are  suggested.  In  general,  the  practical  feasibil- 
ity of  such  a totally  integrated  avionics  system  appears  to  be  limited  only  by 
questions  regarding  the  manageability  of  the  system  software. 


SYMBOLS  AND  ABBREVIATIONS 


e 

Pitch  Attitude 

Q 

D3mamic  Pressure 

$ 

Roll 

P 

s 

Static  Pressure 

Heading 

^T 

Total  Pressure  (P_  - P ) = Q 
T s c 

vd 

Column  Force 
Wheel  Force 

Pp(t) 

Probability  of  failure  in 
time  duration  t 

k , k , A 
x’  y z 

Linear  body  axis  accel- 
erations in  X,  y,  z 

"t 

Total  Temperature 

direction 

T 

s 

Static  Air  Temperature 

h 

Altitude 

V 

c 

Calibrated  Airspeed 

M 

Mach  number 

INS 

Inertial  Navigation  System 
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ILS 

Instrument  Landing  MLS 

System 

Microwave  Landing  System 

CWS 

Control  Wheel  Steering  MFD 

Multi-Function  Display 

DME 

Distance  Measuring 
Equipment 

RATIONALE  FOR  CANDIDATE  SYSTEM  ARCHITECTURE  SELECTION 


Three  generic  candlate  avionics  system  architectures  illustrate  the  re- 
quirements, considerations,  and  controversies  surrounding  the  selection  of  an 
integrated  avionics  approach  for  future  transport  aircraft.  These  three  candi- 
dates are; 

1)  The  Federated  System  — - a combination  of  new  computers  for  each 
required  class  of  functions.  This  is  a direct  extension  of  today's 
technology,  but  the  argument  is  made  that  computers  are  becoming 
sufficiently  inexpensive  that  we  can  afford  the  separate  computers 
of  the  federated  concept.  This  argument  does  not  address  the  pro- 
blem of  intercomputer  communication  and  interface  complexity, 

2)  The  Integrated  System  with  Separate,  Fail-Operative  Flight  Control 
Computers  — a major  acknowledgment  of  the  need  for  integration  but, 
nevertheless , it  continues  to  duplicate  the  majority  of  sensor 
Interfaces  in  order  to  separate  the  fall-operative  guidance 
functions , 

3)  The  Integrated  System  with  Self-Contained,  Fail-Operative  Flight 
Control  Functions  — this  system  involves  a minimum  of  interface 
duplication. 

Trade-off  analyses  of  these  three  configurations  can  be  performed  to  prove 
any  desired  conclusion  merely  by  applying  the  desired  arbitrary  weighting  to 
one  or  more  criteria  of  interest.  Therefore,  rather  than  perform  a quantita- 
tive trade-off  we  will  illustrate  how  a single  parameter,  "the  interface  com- 
plexity," varies  with  each  of  the  candidate  architectures.  It  is  contended 
that  Interface  complexity  is  the  single  most  significant  factor  that  influences 
cost,  complexity  and  reliability  of  digital  systems.  When  the  computation  and 
logic  are  performed  in  software,  the  largest  hardware  function  is  the  acquisi- 
tion and  distribution  of  the  data  required  by  the  computer.  If  we  minimize  the 
scope  and  complexity  of  that  function,  we  create  the  simplest,  least  expensive 
and  most  reliable  system.  With  this  viewpoint  in  mind,  we  can  compare  the 
three  candidates  with  reference  to  Figures  1 , 2 and  3 which  Illustrate  some  of 
the  typical  interactive  elements  of  the  system  requirements. 

Figure  1,  the  federated  combination  of  computers,  is  an  extension  of  the 
1970  state  of  the  art  where  integration  exists  primarily  to  the  extent  of  shar- 
ing sensor  sources  through  relatively  standardized  interface  mechanizations. 
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The  navigation  computer,  in  this  concept,  is  responsible  only  for  area  naviga- 
tion, receiving  navigation  sensor  and  Inertial  Navigation  System  (INS)  inputs. 
The  flight  control  computers  retain  their  traditional  autopilot  and  flight- 
director  modes,  including  autoland;  hence  the  triplex  redundancy  for  the  fail- 
operative  requirement.  Note  that  in  all  candidate  systems,  a separate  flight 
control  electronics  function  is  shown  in  order  to  emphasize  the  fact  that  a 
considerable  amount  of  electronics  are  required  in  addition  to  control  law  and 
logic  computation.  This  electronics  is  associated  with  servo  actuator  drives, 
engage  and  shutdown  controls,  power  conditioning  for  transducer  excitations, 
and  some  signal  conditioning.  Dual,  independent  air  data  computers  feed  the 
navigation  computers,  the  flight  control  computers,  and  dual  EPR/autothrottle 
computers.  Redundant  navigation  receivers  representing  the  ILS  function  feed 
both  the  flight  control  (autoland)  computers  as  well  as  the  navigation 
computers . 

This  candidate  is  rejected  because  it  represents  the  extrapolation  of  the 
traditional  and  presumably  unsatisfactory  approach  to  avionics.  The  problem 
of  unwieldly  interconnections  and  equipment  growth  is  not  adequately  handled 
by  this  configuration.  More  interfaces  are  generated,  and  the  number  of  black 
boxes  grows,  as  we  can  readily  see  in  Figure  1. 

The  second  candidate  (Figure  2)  makes  a reasonable  attempt  at  Integrating 
functions  and  minimizing  black  boxes  and  interfaces  by  using  the  navigation 
computer  as  the  new  integrating  element.  That  computer  complex  incorporates 
all  navigation,  including  air  data  computation  and  thrust  management/ 
autothrottle  computations.  It  also  includes  flight  path  guidance  computations 
other  than  those  associated  with  autoland.  The  weakness  of  this  approach  is 
the  use  of  three  additional  computers  and  their  associated  interfaces  for  the 
basic  autopilot  plus  autoland  guidance  functions.  The  input  interfaces  re- 
quired for  the  flight  control  computers  are:  VHF  navigation  receivers  (ILS), 

air  data  (h,  Q,  h,  V^) , attitude  and  heading,  radio  altitude,  accelerometers 

(A^  and  A^) , and  a considerable  amount  of  mode  selection  logic.  All  of  this 

information,  with  the  possible  exception  of  radio  altitude,  is  also  required 
in  the  navigation  computer.  Moreover,  if  provision  is  made  for  growth  to  MLS, 
then  the  MLS  localizer,  glide  slope  and  DME  will  be  required  Interfaces  for  both 
the  flight  control  and  the  navigation  computers.  What  then  is  the  reason  for 
also  moving  this  information  to  a separate  set  of  flight  control  computers? 

It  can  only  be  the  edict  that  flight  control  functions  are  flight  critical,  as 
implied  by  the  fail-operative  requirements,  while  the  other  functions  are  not. 
Hence,  if  one  assumes  that  fail-operative  capability  is  achieved  with  a minimum 
of  triplex  redundancy.  Candidate  2 is  a natural  conclusion. 

The  simplest  interfacing  of  sensors  is  achieved  with  the  third  candidate 
(Figure  3) . This  system  mechanizes  the  fail-operative  autoland  functions  with 
two  computers.  These  computers  are  shown  Interfacing  with  a triplex  actuator 
control  mechanization,  although  that  interface  could  readily  be  quadruplex. 

Since  the  autoland  architecture  does  not  differ  from  the  system  architecture 
requirements  of  the  non-flight  critical  navigation  functions,  those  navigation 
functions  are  incorporated  in  the  same  computer  complex.  Triplex  navigation 
functions  are  interfaced  with  both  computers , as  in  the  other  candidates , but 
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only  one  set  of  interfaces  is  required.  This  interface  reduction  is  represen- 
tative of  the  significant  minimization  of  electronics  and  wiring  when  this 
level  of  functional  integration  is  implemented. 

Candidate  3 is  based  on  technology  advances  made  in  recent  years  where 
techniques  have  been  developed  that  permit  100-percent  fail-operative  perfor- 
mance with  dual  digital  computers.  We  define  100-percent  fail-operative  as 
follows:  If  the  probability  that  the  best  contemporary  triplex  or  quadruplex 

fail-operative  system  will  respond  properly  to  all  failure  situations  is 

and  the  probability  that  the  dual  digital  system  will  respond  properly  is  P_, 
then 


P2/P^  >1.0 

In  effect,  this  definition  acknowledges  that  all  fall-operative  systems  have 
loop-holes  in  such  matters  as  multiple  simultaneous  failures,  but  the  recom- 
mended dual  system  is  at  least  as  good  as  the  best  contemporary  system  in  re- 
gard to  fail-operative  Integrity. 

If  the  fall-operative  functions  are  mechanized  in  dual  computers  and  will 
meet  every  stringent  safety  ground  rule  for  Cat.  Ill  certification,  why  not  use 
the  same  computers  (using  non-fail-operative  techniques)  for  the  other  func- 
tions? When  we  follow  this  approach,  the  resultant  configuration  yields  a 
major  reduction  in  interface  complexity  and  a significant  reduction  in  the 
number  of  required  black  boxes. 


SYSTEM  ARCHITECTURE,  REDUNDANCY  AND  SUMMARY  OF  FUNCTIONS 


The  recommended  system  organization  is  illustrated  in  Figure  4.  The  dual 
computational  redundancy  is  represented  by  the  pair  of  data  adapters  and  com- 
puters. The  autoland  and  stabilization  and  control  autopilot  functions  that 
must  be  fail-operative  are  contained  within  the  elements  shown  on  this  block 
diagram.  Moving  from  left  to  right  on  the  diagram,  this  is  achieved  through 
the  use  of  appropriate  redundancy  in  the  required  sensors,  special  hardware 
techniques  within  the  data  adapter,  special  software  monitoring  and  data  handl- 
ing routines  within  the  computer,  and  the  necessary  redundancy  to  interface  the 
flight  control  electronics  with  the  aircraft’s  electro-hydraulic  actuation 
system.  The  number  of  flight  control  electronic  units  is  shown  as  n where  n 
may  be  three  channels  or  four.  Whether  the  control  electronics  is  triplex  or 
quadruplex  depends  upon  the  specific  aircraft  application  and  its  servo 
actuator /control  surface  philosophy.  All  other  non-fail-operative  sensing  and 
computational  functions  are  performed  without  these  special  fall-operative 
techniques,  although  very  thorough  monitoring  and  fault  isolation  software 
routines  are  Included  for  non-fail-operative  as  well  as  for  the  fail-operative 
functions . 

A data  adapter,  a computer,  and  a flight  data  storage  unit  (mass  storage) 
make  up  one  computer  complex.  The  data  adapter  is  the  computer's  hardware 
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interface  with  the  physical  world.  It  isolates  the  computer  from  all  problems 
of  electronic  mechanization  so  that  the  computer's  only  contribution  to  the 
system  is  contained  within  its  software.  The  data  adapter  serves  as  a communi- 
cations terminal  for  all  data  transfers,  and  as  a data  conditioning  and  data 
conversion  center  for  its  computer. 

Each  computer  contains  a program  for  performing  all  flight  control,  guid- 
ance, navigation,  automatic  flight  planning,  air  data  computation,  engine  EPR 
(thrust  rating)  computation,  autothrottle  controls  and  associated  display  func- 
tions. In  regard  to  displays,  CRT  instruments  are  recommended  for  the  ADI  and 
HSI.  The  HSI  function  is  implemented  from  a Multi- Function  Display  (MFD)  ^ich 
provides  a moving  map  presentation  (or,  on  pilot  selection,  a fixed  map,  moving 
aircraft  display) . The  computer  provides  all  the  electronic  map  data  process- 
ing; it  receives  continuous  updates  of  data  from  the  flight  data  storage  unit, 
an  air-bearing  disk  memory  that  provides  mass  storage  of  air  navigation  route 
logistic  data.  The  computer  also  contains  programs  that  allow  it  to  perform 
an  automatic  central  integrated  test  function  that  enhances  the  maintenance 
management  of  a major  part  of  the  aircraft’s  avionics  equipment.  It  also  pre- 
sents checklist  information  on  the  MFD  and  includes  interactive  interfaces  with 
the  flight  crew  through  pedestal  mounted  Control  and  Display  Units  (CDUs). 

These  CDUs  are  normally  used  for  automated 'flight  plan  selection  and  modifica- 
tion; however,  their  keyboard  controls  and  associated  alphanumeric  readout  (in 
conjunction  with  the  large  data  display  capability  of  the  MFD) , allow  a con- 
venient man-computer  interface  for  checklist  activity. 

As  shown  in  Figure  4,  switching  controls,  activated  automatically  or  by 
the  crew,  allow  transferring  of  displays  and  sensor  sources  from  left  side  to 
right  side,  and  vice-versa. 


SENSOR  SUMMARY 


The  sensor  requirements  are  covered  as  general  categories  in  Figure  4. 

A list  of  the  sensor  complement  and  a discussion  of  redundancy  requirements 

follows.  In  the  category  of  stabilization  and  control,  sensors  are; 

• CWS  Force  Sensors  (F0 , F$) 

• Yaw  Rate^^  (r) 

m Pitch  and  roll  Attitude*  (0  , $) 

• Heading  **  (^) 

*It  is  recommended  that  pitch  and  roll  rates  be  obtained  as  software-derived 
rates  from  the  attitude  data. 

**Heading  data  free  of  gimbal  errors  is  desirable  because  this  information  is 
used  for  coordinate  transformations  during  turning  maneuvers  in  those  con- 
figurations which  are  not  provided  with  INS.  If  ^ is  obtained  from  a conven- 
tional 2-degree-of-freedom  directional  gyro,  then  a gimbal  error  correction 
algorithm  is  incorporated  in  the  system  software. 
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• Linear  Acceleration  Triad  (A  , A , A ) 

X y z 

• Flap  Position 

• Surface  Position 
The  Air  Data  Sensors  are; 

• Static  Pressure  (P  ) 

s 

• Total  Pressure  (P^) 

• Total  Temperature  (T^) 

(Note  that  angle  of  attack  (a)  may  be  computed  froiij  inertial  and  baro  data.) 

An  Inertial  navigator  is  shown,  although  for  the  configurations  that  do 
not  include  an  INS,  provision  is  made  for  inertial  smoothing  of  radio  naviga- 
tion data,  using  strapdown  accelerometers,  plus  attitude  and  heading  references. 
When  the  INS  is  provided,  its  velocity-north  and  velocity-east  information  is 
used  as  the  basis  of  the  smoothing  algorithm,  and  the  short-term  strapdown  in- 
ertial computations  are  not  needed.  The  radio  NAVAIDS  are; 

• VOR 

• DME 

• ILS 


although  provision  is  included  in  the  data  adapter  for  interfacing  with  the 
future  MLS  system  and  hyperbolic  radio  navigation  systems  such  as  OMEGA. 

The  radio  altimeter  is  required  only  for  the  autoland  and  instrument  ap- 
proach functions.  Engine  EPR  is  needed  for  the  autothrottle  EPR  mode,  and 
throttle  servo  rate  is  needed  because  the  throttle  servo  loop  is  closed  through 
computer  software. 

Redundancy  of  sensors  where  fail-operative  capability  is  required  is  ap- 
proached by  using  the  three  techniques  illustrated  in  Figure  5.  The  first 
(Figure  5a)  feeds  each  sensor  into  each  of  the  dual  computing  channels.  A 
voting,  middle-value  selection  or  averaging  algorithm  is  mechanized  in  the 
computer  software  to  ensure  that  both  channel  1 and  channel  2 use  the  same 
estimate  of  the  sensed  parameter.  Intercomputer  communications,  via  buffered 
serial  data  links.  Inform  each  computation  channel  of  the  estimated  value,  (a, 
e,  U) , and  whether  a sensor  discrepancy  or  anomaly  has  been  detected.  The 
technique  of  Figure  5a  is  the  most  efficient  from  the  standpoint  of  sensor 
equipment  minimization,  least  efficient  from  the  standpoint  of  Interface  com- 
plexity (and  wiring),  and  somewhat  more  complex  in  regard  to  software  complex- 
ity idien  compared  to  the  other  candidate  sensor  configurations. 
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The  second  technique  (Figure  5b)  uses  quadruplex  sensors  arranged  in 
pairs.  As  in  the  first  case,  software  voting  and  averaging  are  used  to  isolate 
faults  and  equalize  the  estimates  in  both  channels.  The  third  arrangement 
(Figure  5c)  uses  Internally  monitored  sensors  that  generate  their  own  valids 
to  Indicate  that  the  data  is  usable.  The  serial  data  exchanges  allow  channel 
equalization.  When  this  method  is  used,  appropriate  interfacing  techniques  are 
employed  to  avoid  the  situation  where  the  valid  is  received,  but  the  data  is 
lost  through  an  open  connector  pin. 

There  are  many  factors  which  enter  into  the  selection  of  configuration  5a, 
5b,  or  5c  for  a specific  sensor.  Some  of  the  considerations  are  logistic.  For 
example,  two  sets  of  dual  sensors  (5b)  may  be  easier  to  maintain  than  three  in- 
dividual sensors  (5a) . Other  factors  involve  safety  guidelines  and  allowable 
probability  that  a failure  may  be  undetected.  For  example,  configuration  5c 
assumed  a self-monitored  sensor.  Modern  radio  altimeters  fall  into  this  cate- 
gory, but  it  may  be  argued  that  the  built  in  sensor  monitoring  is  not  100  per- 
cent effective  and  a finite  probability  may  exist  for  an  undetected  radio 
altimeter  failure  in  the  final  phases  of  an  autoland  approach.  We  may  respond 
to  a stringent  safety  guideline  regarding  radio  altimeters  by  adding  a third 
sensor  and  using  the  configuration  (5a)  approach.  However,  it  can  be  shown 
that  the  validity  determination  for  a given’ sensor  may  be  augmented  within  the 
system’s  monitoring  software  where  state  estimations  from  other  types  of 
sensors  may  be  used  to  verify  a given  sensor  signal.  Thus,  for  example,  a 
radio  altimeter  signal  may  be  analyzed  with  regard  to  its  validity  by  means  of 
comparisons  with  baro-inertlal  estimates  of  the  aircraft's  vertical  velocity. 
Hence  the  5c  sensor  configuration  may  be  justified  over  the  5a  configuration. 


MONITORING  CONCEPT  FOR  DUAL-FAIL-OPERATIVE  FLIGHT  GUIDANCE  FUNCTIONS 


Summary 


The  two  halves  of  the  total,  fail-operative  Digital  Flight  Guidance  Sys- 
tem are  designated  as  channel  1 and  channel  2 (Figure  6)^  Channel  1 has  a dual 
internal  structure  with  the  two  parts  designated  as  channels  A and  B.  Channel 
2's  subchannels  are  also  designated  as  A and  B.  Both  channel  1 and  channel  2 
are  autonomous  of  each  other,  and  each  is  capable  of  operating  as  a fully  moni- 
tored fail-passive  system.  Each  channel  is  designed  to  detect  any  discrepancy 
from  normal  operation  and  activate  safe  shut-down  controls  if  the  discrep- 
ancy is  deemed  to  constitute  a system  failure. 

There  are  several  different  monitoring  techniques  used  to  achieve  100- 
percent  failure  detection  in  each  computer  channel.  Unlike  analog  systems, 
however,  we  cannot  identify  a unique  set  of  malfunctions  with  each  type  of 
monitor.  There  are  very  large  overlaps  in  the  fault  detection  routines.  Four 
different  monitoring  algorithms,  for  example,  may  detect  one  failure.  In  some 
cases  this  overlap  is  exploited  to  permit  partial  shutdowns,  and  in  other  cases 
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only  a total  channel  shutdown  is  permited.  The  following  is  a summary  of  the 
types  of  fault  detection  techniques  that  are  employed; 

• Processing  of  sensor  valid  discretes 

• Sensor  data  validity  and  reasonableness  checking  algorithms 

• Sensor  data  comparison  monitoring  --  variable  thresholds  dependent 
upon  aircraft  state,  signal  amplitude  and  signal  duration 

• Redundant  computations  Internal  to  the  computer  using  separate 
computer  memory  banks  and  comparison  checks  of  results 

• End  around  I/O  checking  — all  outputs  are  fed  back  to  the  computer 
via  the  input  conversion  sections  and  verified  against  the  specified 
output 

• Test  words  continuously  checked  for  all  intrasystem  communications 

• Model  and  comparison  monitoring  of  servo  actuator  responses 

• Software  executive  continuously  verifies  that  the  required  sequence 
of  software  tasks  is  accomplished  each  50  millisecond  iteration 
period 

• External  (to  computer) , dual  hardware  monitors  examine  the  computer's 
output  for  a required  dynamic  signal  pattern  — any  computer  failure 
that  will  prevent  the  execution  of  the  specified  program  will  cause 
the  pattern  to  cease. 

In  addition  to  the  monitoring  algorithms,  all  input  signal  data  are  pro- 
cessed so  that  all  redundant  control  law  computations  are  performed  with  iden- 
tical values  for  all  variables.  Hence  all  control  output  commands  must  be 
Identical.  The  servo  actuator  commands  are  therefore  identical  so  that  servo 
system  monitoring  criteria  are  dependent  only  upon  servo  system  tolerance. 

Some  cross-channel  (between  channel -1  and  2)  computation  equalization  is 
needed,  but  the  amplitude  constraint  on  the  amount  of  equalization  is  a small 
percent  of  the  control  authority.  Cross-channel  equalization  is  needed  to  cor- 
rect for  small  offsets  caused  by  an  occasional  50-milllsecond  time  skew  between 
data  used  in  channel  1 and  channel  2. 


Computer  Executive  and  Hardware  Monitor 

Descriptions  of  the  input  signal  screening,  monitoring  and  equalization 
algorithms  are  beyond  the  scope  of  this  paper.  The  necessary  system  concepts 
can  be  appreciated  as  extrapolations  and  improvements  over  techniques  used  in 
contemporary  analog  systems.  However,  some  additional  comment  is  needed  to 
elaborate  on  the  concept  of  a 100  percent,  self-monitored  computer.  A computer 
system  verification  function  is  used  to  generate  a prescribed  output  signal 
pattern  at  the  end  of  each  iteration  cycle  only  if  a checklist  of  required 
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computation  routines  has  been  completely  satisfied.  The  instructions  for 
checking  off  this  list  are  therefore  interwoven  throughout  the  entire  program 
so  that  if  any  of  the  required  routines  is  not  properly  completed,  or  if  a pro- 
cessor function  is  faulty,  the  verification  signal  pattern  will  not  be  properly 
generated.  This  verification  signal  is  D/A  converted  and  transmitted  to  the 
hardware  monitor  in  the  Data  Adapter  where  it  is  compared  with  a correct  signal 
pattern.  A difference  in  these  signals  will  cause  the  computer  complex  to  shut 
down  safely  (without  servo  command  transients) . Since  the  verification  signal 
is  dynamic  and  must  contain  correct  timing  information  to  be  valid,  a failure 
in  the  verification  signal  path  to  the  hardware  monitor  (such  as  an  open  or  a 
hardover)  will  be  detected,  as  well  as  timing  errors  in  the  computer.  The  com- 
puter system  verification  function  serves  principally  to  detect  massive  com- 
puter failures,  and  does  not  allow  shutdown  of  partial  computation  functions  as 
is  possible  with  the  software  monitoring  functions.  Nevertheless,  there  is  a 
very  ii^timate  relationship  between  the  software  and  hardware  monitoring  func- 
tions. This  is  shown  in  a simplified  representation  in  Figure  7.  In  this  fig- 
ure the  concept  of  an  executive  program  which  generates  a task  list  as  a func- 
tion of  the  status  logic  is  illustrated.  With  the  completion  of  each  of  its 
specified  tasks,  the  program  acknowledges  that  it  is  ready  for  the  next  task 
by  setting  a task-completion  bit.  When  the  real-time  interrupt  that  controls 
the  program  Iteration  rate  occurs , a check  Us  made  to  determine  whether  all  re- 
quired tasks  were  completed.  If  they  were  not,  the  computer  software  recog- 
nizes a computation  failure  and  jumps  to  a failure  response  routine.  It  simul- 
taneously neglects  to  generate  the  correct  output  pattern.  In  this  case  both 
the  software  and  hardware  monitors  will  detect  a failure,  but  the  hardware 
monitor  will  require  a few  cycles  of  incorrect  output  before  it  will  respond. 
For  simplicity,  an  output  pattern  in  the  form  of  a 10  Hz  square  wave  is  illus- 
trated by  Figure  7.  In  practice,  more  complex,  multilevel  patterns  have  been 
used. 


Failures  of  the  digital  computer's  logic  circuitry  associated  with  the  ex- 
ecution of  specific  instructions  will  result  in  the  condition  just  described. 
The  airborne  program  incorporates  techniques  which  deliberately  exercise  the 
instruction  repertoire  so  that  failures  in  repertoire  logic  will  cause  the  pro- 
gram sequence  to  get  lost  — that  is,  the  program  is  forced  to  a wrong  address. 
The  result  is  a program  hang-up  or  loop  where  it  never  reaches  completion  of 
the  specified  tasks.  The  program  will  recognize  the  real-time  Interrupt,  and 
the  machine  may  be  capable  of  executing  shutdown  instructions.  However,  a more 
fundamental  computer  failure,  such  as  loss  of  clock  or  memory  read-write  cir- 
cuitry, will  leave  the  computer  in  a state  where  it  cannot  execute  any  instruc- 
tions. In  that  case,  the  hardware  monitor  will  detect  a fixed  state  on  output 
D rather  than  the  required  dynamic  pattern  on  output  D of  the  figure.  It  will 
thereby  initiate  a system  shutdown  by  commanding  a computer  power-down  and  in- 
terruption of  power  to  D/A  output  commands.  As  mentioned  earlier,  some  dual 
computation  paths  are  also  used  within  the  computer  primarily  to  detect  fail- 
ures associated  with  single-bit  malfvinctions  in  storage  of  data  words.  . 
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BACIOJP  CONCEPTS  AND  RELIABILITY  IMPLICATIONS 


Svunmary  of  Display/Control  Functions 

A complete  description  of  the  cockpit  displays  and  controls  and  their  in- 
terfaces with  the  redundant  computer  complex  is  beyond  the  scope  of  this  paper. 
However,  it  is  essential  that  the  software-controlled  functions  be  identified 
so  that  we  can  devise  an  appropriate  back-up  strategy  for  the  remote  possibil- 
ity of  a total  computer  shutdown. 

Referring  to  the  highly  schematic  cockpit  layout  shown  in  Figure  8,  con- 
sider normal  system  operation  with  computer  complex  No.  1 driving  the  left 
set  of  displays,  and  computer  complex  No,  2 driving  the  right  set  of  displays. 
The  computer/ display  interconnection  may  be  switched,  either  automatically  in 
response  to  failure  detections,  or  manually  by  pilot  selection.  The  primary 
flight  displays  are: 


Multifunction  Display 

The  MFDs  primary  use  is  to  serve  as  an  HSI  incorporating  a moving-map  dis- 
play. In  this  configuration,  it  provides  the  HSI  pictorial  representation  of 
the  flight  situation  with  regard  to  course,  course  deviation,  distance  to  des- 
tination and  heading,  The  reference  path  is  drawn  as  a solid  line  connecting 
waypoints.  Projecting  from  the  aircraft  symbol  is  a trend  vector  depicting 
the  aircraft's  predicted  location  up  to  a software  selectable  time  into 'the 
future.  Behind  the  aircraft  is  a sequence  of  dots  representing  the  previous 
position  history.  Waypoints,  airports,  airways,  landmarks,  VORTAC,  VOR, 

VOR/DME  stations  are  normally  displayed  on  the  map.  The  heading  tape  is  at 
the  top,  with  a digital  readout  of  aircraft  heading.  Scale  factor  selection 
is  provided  on  the  MFD  control  panel  located  to  the  right  of  the  MFD.  Scales 
of  1,  5,  20  and  80  nautical  miles-per-inch  are  provided,  but  these  values  are 
obviously  completely  under  software  control.  When  the  landing  area  is 
reached,  if  the  scale  factor  is  reduced  to  1.0  nautical  mile-per-inch , then 
a runway  symbol  appears,  and  a useful  presentation  in  the  MLS  era  when  ac- 
curate terminal  DME  and  wide-angle  azimuth  to  the  landing  area  is  available. 

The  MLS  accuracy  would  permit  the  use  of  the  fine  scale  map  so  that  naviga- 
tion accuracy  is  consistent  with  map  resolution. 

On  the  left  side  of  the  MFD  display  area,  various  parameters  associated 
with  flight  plan  progress  and  4-D  guidance  (arrival  time)  status  are  presented 
as  alphanumeric  readouts. 

The  map  is  also  displayable  in  the  north-up  mode  (moving  aircraft  fixed- 
map  display)  upon  selection  at  the  MFD  control  panel.  Slewing  controls  move 
the  map  up-down  and  left-right,  with  the  aircraft  symbol  remaining  fixed  at 
its  true  location  on  the  map.  Mode  selection  at  the  MFD  control  panel  permits 
pilot  editing  of  the  map  content.  Other  mode-select  buttons  delete  the  map  and 
allow  the  display  to  list  pages  of  data,  such  as  that  associated  with  route 
planning  or  preflight  checklists. 
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Electronic  Attitude-Director  Indicator 


This  display  presents  the  basic  horizon  presentation  via  instrument  inter- 
faces that  are  completely  autonomous  of  the  computer  system  (not  under  software 
control).  Also  independent  of  software  is  a digital  radio  altitude  readout  in 
the  upper  right  window.  Indicated  airspeed  appears  in  a window  at  the  upper 
left  of  the  screen,  and  the  system  software  provides  a choice  of  which  para- 
meter one  can  display  in  the  window  at  the  upper  center  of  the  screen.  Exper- 
imental work  has  been  done  where  this  window  was  used  to  display  distance  to 
touchdown  (during  final  approach)  in  nearest  .1  nautical  mile,  or  vertical 
speed  in  feet-per-minute. 

Other  information  displayed  and  retractable  (figuratively)  under  software 
control  is  listed: 

• ILS  or  Flight  Path  Window 

Raw  data  deviation  from  the  ILS  flight  path  or  computed  position 
error  from  area  navigation  flight  paths. 

• Flight  Path  Angle  Symbol 

• Flight  Path  Acceleration 

• Flight  Director  Command  Bars 

• Fast-Slow  Indication 

• Perspective  Runway  Symbol  (This  presentation  is  used  when  accurate  DME 
information  to  the  landing  site  is  available , as  in  MLS  systems . ) 

On  the  right  bezel  of  the  EADI  is  a set  of  approach  progress  annunciators. 
Modes  that  are  armed  illuminate  amber,  and  when  engaged  they  illuminate  green. 


Radio  Altitude,  Altitude,  Vertical  Speed,  Airspeed/Mach 
These  indicators  are  clustered  around  the  ADI  in  the  conventional  manner. 


Autopilot  Flight  Director  System  Mode  Annunciator 

The  mode  annunciator  is  an  electronic  display  containing  four  alpha- 
numeric readouts  that  present  the  autothrottle  mode,  vertical  guidance  mode, 
lateral  guidance  mode,  and  autoland  mode.  These  readouts  flash  if  the  mode  is 
being  captured,  and  Illuminate  steady  when  the  mode  is  in  a "track"  phase. 
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Instrument  AFCS/Waming  Display 

The  instrument  /AFCS  warning  display  panel  provides  for  annunciation  of 
subsystem  failures.  A unit  is  located  in  the  primary  viewing  area  on  each  side 
of  the  instrument  panel. 


Dual  Digital  DME  and  Radio  Magnetic  Indicator 

To  the  left  of  the  MFD  is  a basic  RMI  indicator  that  has  direct  interface 
with  the  radio  receivers  and  the  heading  reference  systems  in  order  to  display 
bearing  to  VOR  or  ADF  stations.  It  also  provides  dual  digital  DME  readouts 
through  direct  digital  interfaces  with  the  DME  receivers. 


ATS/EPR  Control  Display  Panel 

This  panel,  located  at  the  bottom  of  the  center  instrument  panel,  serves 
as  the  thrust-rating  readout  and  thrust-mode  selector.  It  also  provides  the 
means  of  engaging  the  dual  autothrottle  servos.  By  selecting  either  the  take- 
off, maximum  continuous,  climb,  cruise  or  go-around  mode,  the  computed  EPR 
limit  for  those  modes  is  displayed  in  conjunction  with  the  total  air  tempera- 
ture. This  instrument  may  also  be  used  to  display  total  and  static  air  temp- 
erature and  true  airspeed. 


Mode  Select  Panel 

The  Mode  Select  Panel  (MSP)  located  in  the  glare-shielded  region  provides 
the  following  control  and  display  capability: 

• Dual  VHF  Nav  Receiver  frequency  readouts  (for  display  of  an  auto- 
matically tuned  station)  or  manual  tuning  override  capability  — 
located  on  left  and  right  side  of  MSP. 

• Speed  Control  mode  select  and  reference  readout  (airspeed  and  Mach 
via  pitch  or  autothrottle  control) . 

• Vertical  Guidance  mode  select  and  reference  readouts.  These  Include 
flight  path  angle  and/or  vertical  speed  and  altitude  pre-select  dis- 
plays and  controls. 

• Autopilot  and  Flight  Director  Engage  Switches,  including  flight 
critical  engage  switches,  turbulence  mode  control  and  engage 
controls  for  autoland,  take-off  and  go-around. 

• Lateral  Guidance  mode  select  and  reference  read-outs.  These  in- 
clude heading  and  course  set  controls  and  display  redundant 
navigation  sources,  plus  means  for  selecting  various  navigation 
guidance  modes  and  displays. 
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Dual  Control/Display  Units  (CDUs) 

Dual  Control/Display  Units  (CDUs)  are  shown  on  the  left  and  right  side  of 
the  pedestal.  These  CDUs  are  normally  used  for  automatic  flight  plan  selection 
and  modification.  However,  their  general  purpose  keyboard  controls  and  associ- 
ated alphanumeric  readout  (in  conjunction  with  the  large  data  display  capabil- 
ity of  the  MFD) , allows  a convenient  man-computer  interface  for  checklist 
activity. 


Backup  Concepts 

The  integrated  system  has  many  of  the  same  reliability  hazards  as  contem- 
porary systems.  If  all  attitude  references  fail  in  flight,  many  of  the  system 
functions  and  modes  are  disabled.  If  all  of  the  NAV  receivers  fail,  a differ- 
ent set  of  functions  and  modes  are  disabled.  The  superior  fault  isolation  and 
failure  assessment  capability  of  the  integrated  system  allows  automatic  recon- 
figuring of  the  navigation  and  guidance  functions  into  alternate  or  degraded 
modes.  The  crew  can  also  participate  in  the  reconfiguring  of  the  system  data 
flow  and  displays  through  control  of  instrument  switching.  The  fewer  black 
boxes  and  the  improved  failure  detection,  isolation  and  annunciation  capabil- 
ity results  in  a significant  improvenient  of  overall  avionics  reliability  and 
utility.  There  is,  however,  one  potential  weakness  that  disturbs  the  critics 
of  avionics  integration.  They  cite  the  possibility  of  losing  all  avionics 
functions  as  a consequence  of  losing  one  or  two  system  elements.  This  crit- 
icism must  be  addressed,  and  the  recommended  approach  must  be  justified  in 
terms  of  system  operational  capability  in  all  failure  situations  as  well  as 
with  quantitative  reliability  analyses  that  show  overall  MTBF  improvement. 

First  it  must  be  emphatically  stressed  that  most  failures,  including 
multiple  failures  in  redundant  channels,  do  not  wipe  out  the  system.  Three 
questions  must  be  answered.  They  are: 

• What  failures  can  wipe  out  the  system? 

• What  is  the  probability  of  such  an  occurrence? 

• What  are  the  backup  provisions  in  the  event  of  such  a failure 
occurrence? 

The  answer  to  the  first  question  is  that  the  loss  of  both  computer  com- 
plexes (Computer  and  Data  Adapter)  will  disable  the  entire  system.  The  pro- 
jected MTBFs  of  the  computer  and  data  adapter  are  5000  hours  each.  Consider- 
ing that  only  one  half  of  single  data  adapter  failures  are  totally  disabling, 
the  probability  of  total  system  loss  in  a 3-hour  flight,  P-p(t)  = ^*p(3)  is 

P (3  hours)  = ,81  X 10  ^ 

r 

Making  allowances  for  combinations  of  other  multiple  failures  which  would 
contribute  to  a total  system  disability,  it  can  be  stated  that  the  probability 
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of  total  system  shutdown  in  a 3-hour  flight  is  about  10  Suppose  we  are  be- 
ing overly  optimistic  on  the  projected  MTBF  and  we  only  achieve  one-half  the 

—6 

MTBF  values  specified.  Then  the  Pj.(3)  rises  to  3.24  x 10  , or,  making  provi- 

sion for  other  disabling  failures,  the  probability  of  total  system  shutdown  in 

—6 

a 3-hour  flight  is  about  4 x 10  (or  four  shutdowns  per  million  flights). 

The  response  to  the  third  question  shows  that  the  backup  provisions  are 
sufficient  to  allow  continued  instrument  flight  (although  not  to  a Cat.  II 
level).  The  following  is  a summary  of  these  backup  provisions: 

0 Both  EADIs  present  horizon  displays  Independent  of  the  computers,  and 
the  attitude  references  are  manually  selectable  from  alternate 
sources . 

« Both  DDBMIs  present  ADF  or  VOR  bearing  (selectable)  and  aircraft 
heading  from  selectable  data  sources.  The  VOR  radials  are  selected 
through  the  Mode  Select  Panel  course-select  knobs  which  contain 
course-reference  synchros. 

• Provision  can  be  made  for  a direct  interface  between  the  heading 
references  and  the  NAV  receivers  and  the  MFD  so  that  a course  line 
pointing  to  the  azimuth  scale  would  represent  the  desired  flight 
path  (localizer  or  VOR  radial).  The  aircraft  sjrmbol  would  be  dis- 
placed from  the  course  line  by  the  course-deviation  signal.  Thus 
the  MFD  reverts  to  a residual  HSI  through  the  use  of  direct,  hard- 
wired interfaces  to  the  required  sensors. 

• Manual  tuning  of  NAV  receivers  is  independent  of  the  computer 
system.  DME  data  to  two  stations  is  coupled  directly  from  the  DME 
receivers  to  the  DME  readouts  on  the  DDRMI  instruments. 

• Both  EADIs  present  radio  altitude  Independent  of  the  computer  sys- 
tem. Also,  the  radio  altimeter  display  is  independent  of  the  com- 
puter system. 

• Raw  data  ILS  (localizer  and  glide  slope  deviation)  is  presented  on 
the  EADIs*  ILS  window  symbol.  Course  deviation  from  VOR  radials 
can  also  be  presented  on  this  display  if  a course  resolver  is  in- 
corporated in  the  course-set  controller  on  the  MSP. 

• Pneumatic  altimeters,  airspeed  indicators  and  vertical  speed  indi- 
cators may  be  located  on  the  center  instrument  panel.  A self-contained 
horizon  instrument  may  also  be  located  on  this  panel.  Another  means  of 
providing  backup  air  data  would  be  the  use  of  a low  cost,  mini-air 
data  computer  having  only  three  outputs:  altitude,  altitude  rate,  and 
airspeed.  These  three  outputs  can  be  encoded  to  provide  the  word  stream 
needed  to  drive  all  air  data  instruments,  following  the  selection  of 
the  backup  air  data  by  an  appropriate  instrument  switching  arrangement. 
The  backup  air  data  would  also  provide  the  required  encoding  for  the 
aircraft's  altitude-reporting  function. 
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• A backup,  redundant,  hardware  yaw  damper  (with  somewhat  degraded  capa- 
bility) is  included  in  the  flight  control  electronics.  That  yaw 
damper  function  is  independent  of  the  computer  system. 

This  leads  to  a final  observation  regarding  logistical  problems,  and  a 
very  significant  departure  from  contemporary  practice.  It  would  appear  that 
the  consolidation  of  several  flight- critical  functions  within  an  Integrated 
system  would  necessitate  the  requirement  that  two  computer  complexes  be  des- 
ignated as  reliability  "dispatch  items"  by  an  operating  airline.  The  provis- 
ioning of  spares  on  a short-haul  route  structure  would  be  resisted  by  airline 
maintenance  policies.  Perhaps  the  minimization  of  the  total  number  of  black 
boxes  would  permit  the  carrying  of  the  spares  aboard  the  aircraft.  With  ad- 
vanced fault  isolation  and  maintenance-management  techniques  inherent  in  a 
sophisticated  digital  system,  it  might  even  be  possible  to  consider  in-flight 
repairs  using  the  on-board  spares. 


SOFTWARE  SUMMARY  AND  CONCLUDING  COMMENTS 


The  system  design  is  organized  into  a software  module  grouping  with  a 
master  executive  program  that  integrates  these  various  modular  routines  and 
performs  such  tasks  as  timing,  system  reconfiguring,  backup  algorithm  selec- 
tion, and  part  of  the  monitoring  functions.  A list  of  software  modules,  the 
estimated  time  per  iteration  in  an  advanced  Sperry  computer,  typical  iteration 
rate  requirements  and  memory  storage  estimates  are  given  in  Table  I.  The  ad- 
vanced Sperry  computer  (designated  RMM-1)  was  designed  for  application  in  the 
post-1975  era,  and  has  some  extremely  high  speed  and  architecture  Innovations. 
Add/subtract  times  range  from  350  to  700  nanoseconds  and  multiply  times,  in- 
cluding memory  access  ranges  from  1.15  microseconds  to  4.2  microseconds  (for  a 
floating  point  multiply) . That  computer  would  be  provided  with  a 32K  plated 
wire  NDRO  memory  for  this  application,  but  Table  I shows  that  the  memory  bud- 
get is  only  17,800  words  (not  including  the  Integrated  test  and  pre-flight 
checklist  tdiich  would  be  contained  in  the  mass  memory  [ disk]  and  transf  erred 
to  the  computer  resident  memory  when  required) . llie  mass  storage  requirement 

”6  “"6 
is  estimated  as  8 x 10  bits  for  worldwide  logistic  data,  or  1 x 10  bits  for 

“6 

regional  data  only.  The  disk  capability  is  10  x 10  bits. 

A perusual  of  Table  I shows  that  the  advanced  computer  would  be  working 
at  less  than  10  percent  of  its  available  time  to  complete  the  entire  computa- 
tion task.  An  estimate  of  the  computer  load  using  a more  contemporary  1974 
machine  (Sperry  1819B)  indicates  that  the  entire  task  could  be  done  in  70  per- 
cent of  that  machine’s  available  time  with  memory  (main  store)  consumption  of 
about  26K  words.  Thus  there  do  not  appear  to  be  any  serious  questions  regard- 
ing whether  the  state  of  the  art  in  avionics  can  meet  the  requirements  of  this 
type  of  system.  One  nagging  question  persists.  Is  the  software  manageable? 
That  is,  can  such  a software  system  that  encompasses  so  broad  a scope  of  fune- 
tlons,  technical  disciplines  and  organizational  responsibilities  be  developed, 
verified  and  configuration-controlled  in  a typical  transport  aircraft  develop- 
ment environment?  Fortunately  for  the  author,  that  question  is  easily  dodged. 


The  answer  is  if  traditional  approaches  and  relationships  between  partici- 
pating parties  (airframe  manufacturers,  avionics  equipment  manufacturers  and 
airlines)  are  maintained.  However,  even  those  digital  system  pioneers  who  have 
survived  to  regret  slogans  such  as  "there  are  no  problems  bficause  it  * s all  in 
the  software,"  will  optimistically  answer  yes  if  the  development  environment 
and  responsibilities  can  be  properly  disciplined.  There  is  pessimism,  however, 
that  'industry  can  achieve  that  organization  and  discipline  in  the  near  future. 


Figure  1 

Candidate  1 , Federated  Computer  System 
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Figure  2 

Candidate  2,  Dual  Navigation  Computerization  Separate 
Fall-Operative  Flight  Control  Computer 


Candidate  3, 
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Figure  3 


Integrated  Dual  Fall-Operative  System 
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Figure  5 

Redundancy  Schemes  for  Sensors 
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Figure  6 

Dual  Fail-Operative  System  Architecture 


967 


Figure  7 

Relationship  Between  Software  Executive  Itonitor 
and  Hardware  Itonitor 
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Figure  8 

Schematie  of  Cockpit  Display  and  Control  Layout 


TABLE  I 


COMPUTER  REQUIREMENTS  SUMMARY 
(BASED  ON  BMM-1  COMPUTER) 


Function 

Typical 
Time  Per 
Iteration 
(M  sec) 

Required 

Iteration 

Rate 

(per  sec) 

Memory 

Storage 

Requirement 

(words) 

Master  Executive 

100 

1 to  20 

1,000 

Autopilot /Flight  Director  Guidance  and 
Stabilization 

• Attitude  Stabilization 

• CWS 

• Vertical  Guidance 

• Lateral  Guidance 

• Autoland 

• Interlocks  and  M>de  Logic 

• Panel  Communication 

• Basic  Monitoring 

2000 

20 

5,700 

Special  Fail-Operative  Routines 

50  to  700 

20 

2,000 

Navigation 

• Pf  6 Nav  from  Navalds 

• Remote  Tuning 

• State  Estimation  (filtering) 

• Flight  Planning  (Waypoint  Data 
Processing,  Updating,  CDU 
Communication 

400 

1 to  20 

4,000 

Air  Data  Computation 

h,  h,  V^,  V^,  M,  T^,  T^,  Q^,  P^ 

175 

20 

800 
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TABLE  I (cont) 

COMPUTER  REQUIREMMTS  SUMMARY 
(BASED  ON  RMM-1  COMPUTER) 


Function 

Typical 
Time  Per 
Iteration 
(M  sec) 

Required 

Iteration 

Rate 

(per  sec) 

Memory 

Storage 

Requirement 

(words) 

Autothrottle/Speed  Coianiand  and  Stall 
Warning  (includes  a computation) 

200 

10  to  20 

400 

EPR/Thrust  Rating  Computation 

125 

1 to  5 

900 

MFD 

2,000 

1 to  20 

3,000 

• Communications  and  Formatting 

• Map  Processing 

Integrated  Test  and  Preflight  Checklist 

— 

4,000 

(Resident  in 
mass  storage) 

Air  Navigation  Logistic  Data 

• Worldwide 

- 

- 

500,000 

• Regional  Only 

62,500 
(Resident  in 
mass  storage) 
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A FORWARD  VIEW  ON  RELIABLE  COMPUTERS  FOR  FLIGHT  CONTROL* 


Jack  Goldberg  and  John  H . Wensley 
Stanford  Research  Institute 


SUMMARY 

We  examine  the  requirements  for  fault- tolerant  computers  for  flight 
control  of  commercial  aircraft  and  conclude  that  the  reliability  require- 
ments far  exceed  those  typically  quoted  for  space  missions.  Examination 
of  circuit  technology  and  alternative  computer  architectures  indicates 
that  the  desired  reliability  can  be  achieved  with  several  different  computer 
structures,  though  there  are  obvious  advantages  to  those  that  are  more 
economic,  more  reliable,  and,  very  importantly,  more  certifiable  as  to  fault 
tolerance.  Progress  in  this  field  is  expected  to  bring  about  better  computer 
systems  that  are  more  rigorously  designed  and  analyzed  even  though  computa- 
tional requirements  are  expected  to  increase  significantly. 

INTRODUCTION 

Current  NASA  developments  in  aircraft  and  aviation  systems  design  require 
a great  increase  in  on-board  computing.  Most  of  the  advanced  aircraft 
designs — e.g.,  configuration-controlled  vehicles,  and  certain  STOL  modes— 
require  extremely  reliable  computations.  NASA  must  therefore  be  assured 
that  it  will  be  possible  to  build  computing  systems  having  the  high  capacity 
and  extreme  reliability  that  its  current  advanced  aircraft  designs  will 
require . 

The  reliability  requirements  far  exceed  those  typically  quoted  for  space 
missions  (95%  success  after  five  years) . This  implies  that  the  probability 
of  error  of  spaceborne  eomputers  is  designed  to  be  on  the  order  of  10"'^/hr 
for  long  missions  while  the  acceptable  figure  for  advanced  avionic  systems 
for  the  commercial  environment  is  on  the  order  of  10“^/hr  for  short  missions . 
The  commercial  environment  also  has  different  certification  requirements, 
not  only  because  of  the  high  public  demand  for  safety,  but  because  the  users 
are  more  diversified.  Thus  the  hardware  and  software  components  of  a computer 
for  commercial  avionics  must  not  only  satisfy  the  reliability  criteria  of 
computer  designers,  but  the  reliability  must  be  convincingly  demonstrated  to 
aircraft  system  designers  and  users.  It  is  well  understood  that  computers 
of  the  needed  power  will  require  a large  number  of  components,  and  that 
this  number  is  so  large  (>10"^)  and  the  assured  reliability  is  so  low  ( >10"^ 


This  work  was  supported  in  part  by  the  National  Aeronautics  and  Space 
Administration,  Langley,  Virginia,  Contract  NASl-10920. 


973 


PAG3  BbM®  m 


failures/hr)  that  some  form  of  built-in  fault  tolerance  is  essential. 
Unfortunately,  the  simpler  forms  of  fault  tolerance  (e.g.,  error  correcting 
codes  and  triple  modular  redundancy)  are  inadequate  for  computers  of  the 
required  size. 

Realization  of  this  inadequacy  has  given  rise  to  several  research  and 
development  efforts  in  the  design  of  automatically  reconfigurable  computers. 

Some  examples  of  computers  carried  to  a fairly  detailed  design  level  are 
STAR  (JPL)  [ref.  1],  EXAM  (NASA -ERG)  [ref.  2],  ARMMS  (NASA •Marshall)  [ref.  3], 
and  MSG  (SAMSO)  [ref.  4].  Other  recent  designs,  at  a less-detailed  level, 
include  SIFT  (NASA-Langley)  [refs.  5 and  6],  an  unnamed  computer,  hereafter 
called  HS  (MIT  G.  S.  Draper  Laboratory)  [refs.  7 through  9].  There  has 
also  been  considerable  research  in  techniques  for  designing  redundant  logic 
networks  and  memories,  for  testing  arbitrary  logic  networks,  and  for  modelling 
redundant  systems.  For  a discussion  of  these  topics,  see  reference  10. 

These  design  and  technique  studies  comprise  a well-rounded,  but  relatively 
unproven  art.  They  do  not  yet  comprise  a base  of  technological  practice 
sufficient  for  the  design  of  computer  systems  whose  reliability  can  be 
specified  with  a high  degree  of  assurance.  This  is  a consequence  of  the  basic 
fact  that  (1)  faults  and  errors  can  occur  in  extremely  varied  ways,  and  (2)  the 
fault-tolerant  behavior  of  an  automatically  reconfigurable  computer  can 
be  extremely  complex. 

Subsequent  sections  of  this  paper  examine  the  computational  and  reliability 
requirements,  the  technology  constraints,  and  estimates  of  the  likelihood  of 
achieving  the  goals. 


GGMPUTATIONAL  REQUIREMENTS 


In  this  section  we  consider  the  computational  and  reliability  require- 
ments of  a representative  aircraft  computer  system.  The  example  we  choose 
is  that  of  a commercial  transonic  four-engine  aircraft.  We  assume  that 
advanced  control  systems  will  be  required  for  such  functions  as  flutter 
control  and  attitude  control.  We  further  assume  that  an  advanced  blind 
landing  system  would  be  used. 

The  requirements  are  reported  in  detail  in  reference  6,  and  are  summarized 
in  table  1.  The  most  critical  phase  of  the  flight  from  a computational  stand- 
point is  during  an  instrument  landing.  Those  applications  involved  in  that 
phase  are  indicated  with  an  Small  tasks  that  are  not  required  during 

that  phase  do  not  influence  the  design  of  the  computer  system  and  therefore 
have  not  been  estimated  to  the  same  accuracy  as  the  more  important  tasks. 

The  column  headings  of  table  1 are  defined  as  follows: 


Task- 


•The  name  given  to  the  application  program. 
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Griticality  Class-— 1 . 

2. 

3. 

4. 

5. 


Immediate  safety-of -flight  impact. 
Eventual  safety-of-f light  impact. 
Significant  change-of -mission  impact. 
Operational  impac  t . 

Economic  impact. 


Table  1 


COMPUTING  REQUIREMENTS  FOR  EACH  CMPUTATIONAL  FUNCTION 


Task 

Criticality 

Class 

Iteration 

Rate(s)/ 

Sec 

Memory  Required 

Missed 

Iterations 

Inst. 

Data 

Attitude  control 

1 

5,20 

0.023 

1845 

230 

2-3 

Flutter  control 

1 

250 

0.069 

70 

22 

2-3 

Load  control 

3,5# 

240 

0.014 

45 

15 

2-3 

Autoland , hor iz . 

# 

20 

Auto land,  vert. 

1# 

160 

0.055 

750 

275 

2-3 

Auto land , thro  tt le 

# 

33 

Autopilot 

4 

5 

? 

150 

100 

4-5 

Elec.  att.  control 

1# 

30 

0.077 

790 

520 

? 

Supervisor 

4 

? 

? 

75 

15 

? 

Inertial 

2# 

1,25 

0.034 

2100 

150 

0-4 

VOR/IME 

4 

5 

0.004 

250 

50 

4-5 

DME,  OMEGA 

4 

5 

?' 

400 

105 

4-5 

Air  data 

4 

? 

? 

110 

25 

4-5 

Kalman  filter 

4 

1/5 

0.001 

250 

65 

2-3 

Flight  data 

4 

5 

0.028 

450 

100 

2-3 

Airspeed,  altitude 

4# 

8,16 

0.009 

360 

70 

2-3 

Graphic  display 

4# 

1,8 

0.032 

890 

5360 

2-3 

Text  display 

4 

10 

0.019 

8700 

4-5 

Collision  avoidance 

4# 

1/3,670 

1-2 

Data  comm,  A/C 

# 

Non- 

? 

iterative 

Data  comm,  ground 

4# 

^ 4 

0.001 

450 

112 

? 

AIDS 

5# 

V4  to  4 

HQh 

4-5 

Inst,  monit. 

4# 

5 

0.014 

800 

2-3 

Syst.  monit. 

1-4# 

1/2 

0.001 

900 

50 

2-3 

Life  support 

1-4# 

<1/2 

0.001 

900 

50 

3-4 

Engine  control 

1-2# 

33 

1300 

200 

1-2 

Tasks  to  be  run  during  blind  landing,  the  most  critical  flight  mode,  are 
marked 

Tasks  marked  "?"  exert  a negligible  load  for  the  parameter  in  question. 
The  column  headings  are  defined  in  the  text. 


Iteration  Rates/Sec — ^The  number  of  times  per  second  that  the  calculation 

must  be  carried  out.  When  two  figures  are  quoted, 
they  represent  two  calculations  within  the  same 
functional  task.  l 

•The  Millions  of  instructions  Per  Second  to  carry  out 
the  calculations. 


Equivalent  MIPS 


Memory  Required-"— — ^The  number  of  words  of  memory  required  for  instructions 

and  data. 

Missed  Iterations — —The  maximum  number  of  consecutive  iterations  that  can 

be  missed  before  the  application  is  jeopardized. 

In  interpreting  the  table  and  discussing  its  implications  on  computer 
architecture,  we  consider  reliability,  roll-back  delay,  main  memory  requirements, 
processor  speed,  processing  variations  within  a mission,  and  data  rates. 

Reliability 

We  assume  that  the  probability  of  not  successfully  carrying  out  the  most 
critical  computation  should  be  less  than  10"®  per  mission.  These  computations, 
corresponding  to  criticality  classes  1 and  2,  could  cause  an  aircraft  crash 
if  not  carried  out  or  if  carried  out  with  gross  errors.  With  this  assumed 
computation  reliability,  for  a fleet  of  1000  aircraft  flying  four  daily 
missions,  each  of  five  hours  without  repair  between  flights  within  a day, 
about  one  crash  due  to  a computer  failure  would  occur  in  100  years.  For  the 
other  criticality  classes,  the  assumed  reliability  is  not  as  stringent~a 
t5rpical  failure  probability  is  10“4 — since  the  failure  to  carry  out  these  less 
critical  computations  results  in  only  a mission  change  or  an  economic  loss. 

In  a system  design,  it  would  be  beneficial  to  so  allocate  redundancy  that  each 
task  is  carried  out  with  the  indicated  reliability. 

Roll-back 

An  important  parameter  of  a fault-tolerant  computer  is  the  maximum  time 
interval  that  the  computer  can  be  in  a roll-back/re configuration  mode  in 
responding  to  a failure.  During  this  interval  some  processing  of  certain 
computations  may  cease,  and  newly  appearing  data  might  be  lost.  The  missed 
iterations  column  of  table  1 indicates  the  number  of  iterations  that  can  be 
ignored  in  a given  computation  without  adversely  affecting  the  aircraft.  In 
the  worst  case  (collision  avoidance)  the  system  must  be  "down”  for  no  more 
than  1.5  msec.  Several  other  critical  computations — flutter  control,  load 
control,  autoland^ — require  reconfiguration  times  nearly  as  short.  For  these 
computations,  it  might  be  necessary  to  reload  programs,  which  indicates  that 
the  ccMputer  might  be  required  to  be  totally  engaged  in  reconfiguration 
following  a failure.  Fortunately,  the  computations  with  large  amounts  of  data, 
e.g,,  display,  can  tolerate  a downtime  of  approximately  0,5  sec.,  thus  allowing 
ample  time  for  the  possible  reloading  of  data,  interleaved  with  the  more 
critical  computations. 


Memory  Requirements 

The  application  programs  for  the  critical  phase  require  approximately 
20K  words.  This  figure  is  a low  estimate  for  two  reasons: 

• The  difficulty  of  estimating  accurately 

® The  need  for  memory  space  for  the  executive  routines. 
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Hence  we  assume  a total  memory  requironent  of  24K  words.  Note  that  this  is  a 
nonredundant  requirement;  the  demand  for  fault  tolerance  will  increase  this 
figure.  For  architecture  relying  totally  on  triplication,  this  storage 
requirement  must  be  tripled  to  72K,  For  architectures  utilizing  only  single- 
byte  correction  (ref.  10)  in  memory  (plus  iwssibly  a few  extra  bytes  for 
double-byte  detection  and  sparing) , the  fi^re  is  about  one-third  in  excess 
of  24K  or  about  32K. 


Processor  Speed 

For  the  critical  phase,  the  application  tasks  require  0.386  MIPS  (millions 
of  instructions  per  second) . Once  again  we  must  regard  this  figure  as  being 
low  in  part  due  to  inaccuracies,  but  mostly  due  to  the  "wasted"  CPU  power  in 
multiprogramming  and  the  processing  of  executive  routines.  For  these  reasons 
we  assume  a processor  load  of  0.5  MIPS,  An  important  attribute  of  the 
computations  is  their  relative  independence.  That  is,  the  sharing  of  ftinctions 
and  data  among  the  computations  does  not  substantially  reduce  the  overall 
memory  or  processor  requirements.  Each  computation  requires  access  to  the 
state  of  the  aircraft,  but  most  other  data  can  be  considered  to  be  local. 

Hence  it  is  quite  simple  to  impose  a multiprocessor  discipline  on  the  computa- 
tions, with  almost  an  arbitrary  number  of  processors. 

Under  certain  allocation  of  tasks  to  processors  it  is  not  necessary  to 
do  any  task  interruption  within  a processor.  That  is,  a task  can  be  allowed 
to  run  through  completion  before  initiating  another  task.  Five  processors 
each  of  0.1  MIPS  would  enable  such  an  allocation.  However,  near  the  end  of  the 
useful  life  of  the  computer,  say  if  just  one  or  two  unfailed  processors  remain, 
it  is  possible  that  a high-rate  task  (flutter  control)  might  be  allocated 
to  the  same  processor  as  a low-rate  but  long  task  (graphic  display).  If  such 
a joint  allocation  is  unavoidable,  then  interruption  of  the  longer  task  will 
be  essential . 


Processing  Variations  Within  a Mission 

All  applications  marked  with  are  required  dxiring  an  instrument  landing. 
This  represents  about  60  percent  of  the  total  CPU  requirement  and  about  50 
percent  of  the  memory  requirement.  Hence  some  graceful  degradation  is 
possible  as,  during  the  mission,  tasks  will  be  naturally  deallocated  as  they 
are  no  longer  needed  as  part  of  the  flight.  Hence,  when  a task  is  no  longer 
needed,  its  memory  area  can  be  allocated  to  another  task,  or,  a failure  in  a 
memory  module  is  automatically  handled  by  a memory  module  with  a reduced 
requirement.  However,  we  note  that  the  degradation  with  respect  to  memory 
is  not  uniform,  assuming  that  all  programs  and  constants  are  retained  In 
main  memory.  For  example,  in  mid-flight,  although  not  all  tasks  are  being 
processed,  all  programs  must  be  stored  reliably  in  the  main  memory.  Hence  the 


The  issue  of  back-up  memory  in  an  aircraft  environment  is  yet  to  be  completely 
resolved.  Rugged  discs  can  be  obtained  but  their  cost  per  bit  is  not 
significantly  less  than  that  for  LSI  main  memories. 
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graceful  degradation  with  regard  to  main  memory  is  not  exploitable  until  the 
last  minutes  of  the  flight,  and  hence  is  of  questionable  utility  to  the 
architecture . 


Data  Rates 

An  important  measure  of  computer  power  required  is  the  load  on  the  bus 
structure  for  transfer  of  instmctions  and  data.  Given  a computing  load 
of  0.5  MIPS,  we  assume  that  an  instruction  will,  on  average,  require  24 
bits.*  Different  instsmctions  require  varying  amounts  of  data  including  the 
following  cases; 

• 0 bits  for  register-to-register  operations 

• 8 bits  for  byte  operations,  e.g.,  text  display 

• 16  bits  for  integer  operations 

• 32  bits  for  floating  point  operations. 

Based  on  an  estimate  that  the  average 'data  required  is  16  bits,  the  total 
flow  between  memory  and  CPU  is  20  Mbits/sec.  In  some  architectures  (e.g., 
the  JPL  STAR),  the  bus  would  have  to  be  capable  of  maintaining  this  rate. 

In  the  case  of  the  Hopkins  scheme,  a significant  reduction  would  be  achieved 
by  the  use  of  the  local  CACHE  on  the  processors.  An  additional  reduction  is 
achieved  by  providing  a multi-bus  structure  or  allowing  multiple  ports  into 
main  memory.  In  the  SIFT  system,  most  of  the  bus  load  would  be  in  individual 
modules,  with  only  an  estimated  one  percent  between  modules. 

TECHNOLOGICAL  ADVANCES 

The  most  important  future  development  in  technology  is  expected  to  be 
the  continued  improvements  in  LSI.  The  cost  of  LSI  circuits  will  continue 
to  drop  throughout  the  1970s,  and  will  result  in  processor  and  memory  costs 
that  are  low  enough  so  that  extensive  redundancy  of  units  is  practical  from 
a cost  viewpoint.  This  redundancy  can  be  either  by  replication  or  by  coding, 
the  latter  being  more  applicable  to  memories.  It  is  expected  that  the  cost 
of  a computer  system  to  carry  out  all  computation  within  an  aircraft  will  be 
comparable  with  the  present  cost  of  existing  single -function  avionic  units 
(e.g.,  inertial  navigation) . 

A second  advantage  in  the  use  of  IBI  is  the  small  size  of  such  units, 
making  it  possible  to  achieve  far  more  efficient  shielding  from  both  electric 
and  magnetic  fields,  thereby  reducing  the  probability  of  noise  and  crosstalk. 
It  is  expected  that  fault  modes  of  this  type  (which  are  manifested  as  data- 
dependent  transient  faults)  will  be  insignificant  within  the  central  units. 
However,  such  faults  may  still  exist  in  connections  to  external  sensors  and 
actuators . 


In  a 16-bit  computer  this  implies  equal  number  of  single-  and  double-length 
instructions. 
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With  the  use  of  LSI  most  of  the  connections  at  the  device  and  gate  level 
take  place  within  the  semiconductor  device , or  chip,  rather  than  on  a*  board 
or  through  a connector  as  in  the  use  of  discrete  circuits.  The  number  of 
soldered  and  wrapped  Joints  is  estimated  to  be  at  least  an  order  of  magnitude 
less  than  that  associated  with,  say,  integrated  circuits,  thus  there  would  be 
consequent  reduction  of  faults  in  the  connection  system* 

LSI  circuits,  though  relatively  cheap  in  high-volume  production,  have  a 
high  development  cost.  This  implies  that  an  efficient  design  would  contain 
as  small  a number  of  different  chip  types  as  possible.  This  affects 
architectural  decisions  at  two  levels.  At  the  unit  level  (memory,  bus, 
arithmetic  unit,  control,  etc,),  there  will  be  strong  advantage  in  using 
replication  of  identical  units  rather  than  units  designed  specifically  for 
particular  functions.  At  the  logic  level,  the  high  development  cost  of  custom 
built  units  makes  it  more  attractive  to  transfer  arbitrary  logic  to  a form 
of  memory  as  in  the  use  of  microprograraming. 

Replacement  and  maintenance  strategies  in  a reconfigurable  computer  are 
also  influenced  by  LSI.  The  large  number  of  gates  per  chip,  together  with 
the  tendency  for  a chip  fault  to  affect  many  gates,  implies  that  groups  of 
registers  on  the  same  chip  should  he  replaced,  rather  than  replace  small  units 
such  as  registers. 

The  choice  of  LSI  technologies  is  between  the  lower-speed,  lower-cost 
MOS  and  the  higher-speed  and  higher-cost  bipolar  technologies.  The  total 
computing  power  required  among  the  elements  of  the  several  candidate 
architectures  is  such  that  MOS  will  be  sufficiently  fast  for  memories,  buses 
and  arithmetic  units.  In  addition,  the  use  of  a multiprocessor  organization 
permits  the  attainment  of  high  computation  capacity  with  slower  processors. 

The  higher  speed  of  bipolar  circuits  may  still  be  necessary  in  the  control 
sections  where  the  microprogram  cycle  time  will  tsnpically  be  an  order  of 
magnitude  faster  than  the  instruction  cycle  time*  Recent  advances  in 
technology  have  tended  to  bring  the  two  types  closer  in  both  speed  and  cost. 

We  note  that  the  choice  between  different  LSI  technologies,  discussed 
above,  was  on  the  basis  of  speed  and  cost.  The  lower-cost  alternative  of  MOS 
is  possible  because  of  the  higher  density  within  the  chip,  thereby  enabling 
the  use  of  fewer  chips.  This  will  have  the  desirable  effect  of  increasing 
the  inherent  reliability  due  to  the  reduction  in  ntimber  of  chips.  LSI  memory 
systems  appear  to  be  potentially  more  reliable  than  core  or  plated  wire, 
because  of  the  reduced  numbers  of  discrete  semiconductor  devices  and  inter- 
connections. The  use  of  batteries  is  deemed  to  be  a fully  adequate  assurance 
of  non-volatility.  ^ 

The  MTBF  for  LSI  circuits  is  estimated  to  be  between  10®  and  10^  hours. 
The  requirement  to  achieve  a MTBF  of  10^  hours  for  the  whple  system  can  be 
shown  to  be  achievable  by  several  architectures. 

j 

The  use  of  optical  coupling  between  xmits  can  provide  great  protection 
against  damage  propagation  through  several  units.  The  architecture  must 
therefore  be  more  concerned  with  fault  propagation  through  erroneous  data 


979 


than  by  adverse  electrical  phenomena.  The  added  cost  for  such  protection 
is  substantial,  though  not  prohibitive,  so  careful  design  to  achieve  fault- 
isolation  is  required. 

DESIGN  CONSIDERATIONS  FOR  FAULT-TOLERANT  COMPUTER  ARCHITECTURES 

In  the  preceding  sections  we  have  discussed  the  requirements  for  fault- 
tolerant  aircraft  computers,  and  the  impact  of  new  technology  on  their 
design.  We  now  consider  some  representative  computer  a:|f’chitectures  from 
the  viewpoint  of  cost  and  reliability. 

Many  possible  computer  structures  exist  to  satisfy  the  requirements  and 
it  is  not  our  intent  here  to  survey  all  existing  or  polpsible  designs,  but 
rather  to  look  at  a small  number  of  designs  in  order  to  compare  the  use  of 
different  fault- tolerance  techniques.  We  choose  three  designs — multichannel, 
SIFT,  and  SIFT  with  coding  in  memory. 

In  the  multichannel  design,  a number  of  identical  computers  are  used 
with  all  computers  operating  identically  on  the  tasks  to  be  performed.  The 
computers  are  operated  in  a lock-step  mode  with  all  data  movement  being  checked 
by  voters  that  are  connected  to  the  buses.’  A typical  number  of  channels  would 
be  three,  four  or  five,  higher  numbers  being  unnecessary  and  tending  to 
complicate  the  design  of  the  voters. 

In  the  SIFT  design,  a ntimber  of  computers  are  also  used  but  they  do  not 
operate  in  lock-step  mode,  and  they  do  not  all  operate  on  the  same  tasks. 
Error-detection  is  achieved  by  comparison  of  results  of  calculations  carried 
out  in  several  computers,  this  comparison  being  by  program,  not  by  a hardware 
voter.  An  important  characteristic  of  the  design  is  that  the  buses  connecting 
computers  are  constrained  so  that  each  computer  cannot  write  into  the  memory 
of  the  other  computers.  This  greatly  improves  fault  Isolation  between  computers. 
Reconfiguration  is  also  carried  out  by  software  in  a system  executive  that  is 
itself  replicated  to  assure  adequate  reliability. 

In  the  thii’d  design  to  be  considered,  the  processors  operate  as  in  the 
SIFT  design,  but  coding  is  applied  to  protect  against  faults  in  memory. 


We  now  consider  each  of  the  above  designs.  In  all  cases  we  assume  a 
chip  failure  probability  of  10“®/hr.  We  use  the  notation  that  P[event]  = 
probability  of  the  event  occurring  per  hour. 

We  distinguish  between  the  most  critical  (MC)  tasks  where  error*  probabili- 
ties should  be  below  10“9/hr  and  the  least  critical  (LC)  tasks  where  errors 
should  be  below  10“Vhr.  We  also  distinguish  those  tasks  required  for  automatic 


In  this  analysis,  we  do  not  distinguish  between  erroneous  outputs  to  actuators 
and  null  outputs.  A more  comprehensive  analysis  would  need  to  make  this 
distinction. 
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’blind’  landing  and  other  tasks.  The  landing  phase  is  the  most  demanding  in 
terras  of  computing  load.  We  summarize  in  table  2 a representative  set  of 
requirements,  where  M is  memory  requirements  in  thousands  of  words  and  P is 
processor  requirements  in  MIPS. 


Table  2 

CX)MPUTATION  AND  MEMORY  REQUIREMENTS 


Landing 

Other 

Most  Critical 

P = 0.29 
M = 8.8 

P = 0.09 
M = 2.2 

Least  Critical 

P = 0.9 
M = 6.8 

P = 0.05 
M = 5.5 

We  assume  that  words  contain,  on  the  average,  24  information  bits.  We 
further  assume  that  a memory  chip  contains  bits,  and  that  it  requires  30 
chips/MiPS  to  realize  the  CPU. 

Case  1:  Multichannel 

We  assume  107o  extra  memory  and  processor  requirement  to  handle  the 
multiprogramming  and  other  executive  requirements  (interrupt  handling,  etc.). 
The  multichannel  concept  requires  enough  memory  in  each  channel  to  hold  all 
tasks  (23. 2K  + 10%  2SC),  and  the  CPU  must  handle  the  heaviest  task  load 

(0.38  + 10%  0,42  MIPS) . Therefore  for  each  channel  we  have 


26K  words  = 156  chips 
0.42  MIPS  «=!  13  chips 


} 


170  chips 


Assume  that  the  chips  in  the  voter  (sufficiently  replicated  for  reli- 
ability) are  negligible  and  consider  the  probability  of  error  for  three-,  four- 
and  five-channel  configurations.  The  results  are  displayed  in  table  3. 


Case  2:  SIFT  With  Fault  Tolerance  Achieved  by  Uniform  Replication 


For  this  case,  the  strategy  is  to  triplicate  all  tasks,  and  when  faults 
occur  to  reduce  the  LX;J  tasks  to  duplicate,  then  single  processors,  finally 
removing  them  entirely  in  the  event  that  resources  are  drastically  reduced. 

We  assume  20%  overhead  for  executive  plus  voting  routines.* 

The  memory  and  processor  requirements  are  as  in  table  4.  The  reliability 
results  are  displayed  in  tables  5 and  6,  for  a SIFT  system  decomposed  into 
four  and  ten  modules,  respeetively. 


This  estimate  (of  20%)  is  not  critical  in  determining  the  component  count, 
the  cost  or  the  reliability  of  the  design. 
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Table  3 


RELIABILITY  ESTIMATES  FOR  MULTICHANNEL  SYSTEM 

3 Channel 

Total  chips 
P[1  fault] 

P[2  faults] 

4 Channel 

Total  chips 
P[1  fault] 

P[2  faults] 

P[3  faults] 

5 Channel 

Total  chips 
P[1  fault] 

P[2  faults] 

P[3  faults] 

P[4  faults] 


Table  4 

SIFT  PROCESSOR  AND  MEMORY  REQUIREMENTS 


Landing 

Other 

Most  Critical 

P = 0.35 
M = 10,4 

P = 0. 11 
M = 2.6 

Least  Critical 

P = 0. 11 
M = 8. 2 

P = 0. 06 
M = 6.6 

Total  memory  requirement  = 27.8«i28K 
Maximum  CPU  requirement  = 0. 46  MIPS 


= 540 

—3 

= 0.51  X 10  voting  masks  error,  discard  faulty 

channel 

-6 

= 0.17  X 10  ,4..  .system  failure 

= 680 

-3 

= 0.68  X 10  ,....voter  removes  faulty  channel 
“6 

= 0.34  X 10  voter  masks  second  fault,  discard  faulty 

channel 

= 1,2  X 10  .system  failure 

= 850 

—3 

= 0. 85  X 10  , , . . . voter  removes  faulty  channel 

6 

= 0.58  X 10  , ....voter  removes  faulty  channel 

-9 

= 0.3  X 10  ,.... voter  masks  fault,  discard  faulty 

channel 

-13 

= 1 X 10  ,... system  failure 
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Table  5 

RELIABILITY  ESTIMATES  FOR  A 4-MODULE  SIFT 


Each  memory  = (28  X 3)/4  = 21K  = 126  chips  "S  chips 

Each  CPU  = (0.46  X 3)/4  = 0.35  « 10  chips  / 

Total  chips  s:  544 

We  denote  MC  during  landing  as  MC/L  etc. 

P[1  fault]  = 0.54  X 10"3,  M = 63K,  P = 1.05 
During  Landing:  Remove  LG,  MG  survive 

During  Other:  MC  survive,  all  LG  to  SIMPLEX,  future  removal  LC/L 

P[2  faults]  = 0.22  X 10"^,  M = 42K,  P = 0.70 
During  Landing:  MC/L  only  survive  in  DUPLEX 

During  Other:  All  MC  to  DUPLEX  in  memory,  all  LC  to  SIMPLEX,  future  removal 
of  LC/L 

P[3  faults]  = 0.6  X lO”^®,  System  failure 

Table  6 

RELIABILITY  ESTIMATES  FOR  A lO-MODULE  SIFT 


Each  memory  = (28  X 3)/10  = 8.4K  = 51  chips  . 

1 55  chips 

Each  CPU  = (0.46  X 3)/10  =0.14  4 chips  J 

Total  chips  = 550  chips 

P[1  fault]  = 0.55  X lO"^,  M = 75. 6K,  P = 1.26 
During  Landing:  Fault  masked,  LC  to  DUPLEX 

During  Other:  Fault  masked,  LC/0  to  DUPLEX,  Future  LC/L  to  DUPLEX 

P[2  faults]  = 0.27  X 10“6,  M = 67. 2K,  P = 1.12 
During  Landing:  MC  fault  masked,  LC  failed 
During  Other:  Fault  masked,  Future  LC/L  fail 

P[3  faults]  = 0.19  X 10“®,  M = 48. 8K,  P = 0.98 
During  Landing:  MC  fault  masked,  MC/L  to  DUPLEX 
During  Other:  Fault  masked.  Future  LC/L  fail 

P[4  faults]  = 0.73  X 10  , M = 40. 4K,  P = .84 

During  Landing:  Possibility  of  system  failure 
During  Other:  Possibility  of  LC  failure,  future  MC/L  in  DUPLEX 
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Case  3:  SIFT  with  Coding  in  Memory 

The  majority  of  chips  for  SIFT  in  Case  2 are  used  in  the  memory.  We  can 
add  protection  by  using  an  error  detecting/correcting  code.  The  analysis  dis- 
played in  table  7 is  for  a single-error-correcting,  double-error-detecting  code 
with  an  assumption  of  25%  increase  in  memory  cost.  A module  failure  requires 
failure  of  one  chip  in  the  CPU  or  two  chips  in  the  memory.  Low  criticality  tasks 
are  run  in  SIMPLEX  mode, 


Table  7 

RELIABILITY  ESTIMATES  FOR  FOUR-  AND  SIX-MODULE  SIFT 
WITH  CODING  IN  MEMORY 


4 Module 

Memory  per  module  = (13  X 2 + 15)/4  + 25%  13K  = 78  chips 

CPU  per  module  ==  (0.35  X 2 + 0.11)/4  0.2  = 6 chips 

Total  chips  = 332 

P[CPU  fault]  = 0.6  X 10”^/per  module 

-4 

P[single  memory  fault]  = 0^8  X 10 
P[double  memory  fault]  = 0.6  X 10 
P[LC  task  failure]  = 0.6  X lo"® 

_3 

P[ reconfiguration]  = 0.3  X 10 

-7 

P[second  module  fail]  ==  0.8  X 10 
P[MC  task  fail]  = 1.3  X lo"^^ 


^ 84  chips 


6 Module 

Total  chips  = 348 
P[LC  fail]  = 0.4  X lo“ 
P[MC  fall]  = 0.2  X 10“ 


The  above  analysis  is  portrayed  in  figure  1 which  shows  the  relationship 
between  number  of  chips  required  and  the  probability  of  failure  of  the  most 
critical  tasks. 

We  conclude  that  all  these  architectures  are  capable  of  achieving  the  re- 
quired reliability  given  sufficient  replication.  Using  triplication,  both  of 
these  architectures  are  capable  of  achieving  a reliability  of  failure  in  the 
region  of  lO""  to  10""^/hr,  Where  reliability  requirements  are  more  stringent, 
as  in  the  case  for  commercial  aircraft,  the  multichannel  approach  can  only 
achieve  sufficient  reliability  at  a cost  significantly  higher  than  that  achiev- 
able by  the  SIFT  architecture.  In  both  cases,  the  use  of  coding  in  memory  can 
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P[MC  fail] 


NUMBER  OF  CHIPS 

SA-1 406-1 R 

FIGURE  1 PROBABILITY  OF  FAILURE  OF  MOST 

CRITICAL  FUNCTIONS  P[MC  fail]  AGAINST 
NUMBER  OF  CHIPS 
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have  a significant  impact  on  reliability  and  cost  by  handling  single-error  cor- 
rection and  double-error  detection  in  memory  in  a very  economic  manner, 

FACTORS  INFLUMCING  FUTURE  COOTUTER  ARCHITECTURES 

We  have  discussed  in  the  preceding  sections  the  problems  of  designing 
fault- tolerant  computers  for  advanced  avionics  requirements.  We  now  examine 
the  forces  that  will  influence  such  computer  designs  in  the  future,  particular- 
ly the  period  1980-85.  We  see  three  types  of  influences:  changes  in  require- 
ments, advances  in  technology,  and  maturity  in  this  specialized  design  field. 

In  looking  at  requirements  we  expect  to  see  an  increase  in  the  computing 
load.  To  a large  extent,  this  will  be  due  to  the  trend  towards  aircraft  de- 
signs that  requires  substantial  real-time  control  systems  for  critical  func- 
tions. Obvious  examples  are  in  flutter  and  attitude  control.  In  addition,  the 
operational  modes  of  commercial  aircraft  will  change.  We  would  expect  to  see 
more  extensive  use  of  automatic  blind-landing  systems,  collision-avoidance 
systems,  and  automatic  or  semi-automatic  route-control  systems.  In  summary, 
we  see  a greater  requirement  due  both  to  more  advanced  aircraft  designs  and  to 
a wider  range  of  operational  modes. 

The  most  significant  development  of  technology  in  the  late  1970s  is  ex- 
pected to  be  the  wide  application  of  large-scale  integrated  (LSI)  technology. 

This  will  cause  several  effects.  First,  we  observe  that  low-cost  production 
of  LSI  circuits  relies  upon  large-volume  production  and  therefore  there  will 
be  a strong  incentive  to  use  standard  circuits  whenever  possible.  This  will 
greatly  influence  the  type  of  acceptable  computer  architectures.  Design  con- 
cepts, such  as  discussed  in  the  preceding  section,  are  the  types  that  will  be 
favored  compared  with  designs  relying  upon  specialized  logic  to  carry  out  the 
various  functions  associated  with  fault  tolerance. 

The  second  effect  will  be  that  the  demonstrable  inherent  reliability  of  a 
circuit  will  be  available  only  on  large-production-volume  devices.  This  effect 
will  be  another  force  towards  the  use  of  standardized  circuits  whenever  possible. 
A third  effect  of  LSI  development  will  be  the  availability  of  back-up  storage 
units  based  upon  electronic  (i.e.,  non-mechanical)  technology.  Such  develop- 
ments as  bubble  or  charge-coupled  memories  potentially  can  be  used  to  hold  data 
either  for  later  use,  or  for  re-entry  into  main  memory  after  a memory  fault. 

The  third  significant  force  that  will  influence  future  avionics  computers 
stems  from  the  increasing  maturity  in  this  field.  Most  designs  in  the  past 
were  arbitrary  designs  developed  ^ vacuo , i.e.,  each  design  effort  did  not 
rely  upon  results  of  other  efforts.  There  was  little  that  could  be  taken  from 
one  effort  to  assist  another.  This  is  now  changing  so  that  the  community  of 
fault-tolerant  computer  designers  can  borrow  from  the  results  of  others.  Notable 
examples  of  this  expanding  technology  base  are  error  correcting/detecting  codes, 
reliable  switches,  and  reliable  clocks.  We  still  see  deficiencies  in  the  tech- 
nology base,  but  expect  that  with  continued  research,  they  will  disappear. 

The  most  notable  present  deficiencies  are  in  the  field  of  reliability  modeling 
and  in  the  area  of  certification.  Reliability  modeling  as  an  art  at  present 
tends  only  to  be  able  to  analyze  very  idealized  systems  and  must  make  very 
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simplifying  assumptions  (e.g,,  that  faults  are  independent  and  permanent).  We 
expect  that  reliability  modeling  techniques  will  be  developed  to  the  point  where 
more  realistic  reliability  analyses  can  be  carried  out.  In  considering  any 
fault- tolerant  architecture,  one  is  faced  with  the  problem  of  certification  of 
the  procedures  used  for  achieving  reliability.  These  procedures  may  be  imple- 
mented in  either  hardware  or  software,  but  whichever  implementation  is  used 
there  is  a need  to  prove  that  the  desired  reliability  characteristics  are 
achieved.  The  present  progress  in  the  field  of  program  proving  gives  us  grounds 
to  believe  that  formal  proofs  of  fault-tolerant  behavior  will  be  possible. 

To  summarize,  we  see  a strong  trend  towards  the  use  of  LSI  circuitry  with 
its  attendant  reduction  in  the  number  of  devices,  thus  greatly  improving  the 
intrinsic  reliability  of  computers.  In  addition,  we  expect  advances  in  the 
theory  and  practice  of  designing,  analyzing  and  certifying  fault-tolerant  com- 
puters for  aircraft  control  applications. 

We  see  the  greatest  need  for  improvement  in  techniques  as : 

(a)  Structures  for  logic,  systems,  and  software  that  provide 
both  high  levels  of  fault  tolerance  and  ease  of  analysis, 
without  the  penalty  of  gross  inefficiency  or  too  inflexible 
a structure. 

(b)  Economical  and  accurate  methods  for  verifying  the  correctness 
of  system  hardware  and  software  with  respect  to  fault  tolerance 
and  proper  servicing  of  application  programs. 

However,  there  appears  to  be  no  fundamental  reason  why  very  reliable  com- 
puters  cannot  be  built  within  reasonable  economic  constraints.  We  would  en- 
visage such  computers  to  use  more  than  one  technique  to  achieve  adequate 
reliability.  The  main  techniques  would  be  replication,  coding  and  reconfigura- 
tion. 


CONCLUSIONS 

In  some  new  aircraft  types  under  development  there  is  a need  for  compu- 
tational resources  to  handle  very  critical  functions,  indeed,  the  safety  of 
the  aircraft  will  be  dependent  on  the  correct  functioning  of  the  computer. 

In  addition,  the  combination  of  high  reliability  and  substantial  computational 
load  needed  for  future  aircraft  makes  the  use  of  simple  redundant  computer 
conf igurations  impractical . 

The  present  reliability  art,  together  with  continually  improving  technology, 
promises  substantial  improvements  within  the  next  five  years  for  those  aircraft 
applications  with  only  modest  computational  loads.  However,  to  meet  all  the 
larger  set  of  computational  requirements  that  have  been  suggested,  at  the 
necessary  reliability  levels,  advances  in  the  art  of  fault  tolerant  computer 
design  will  be  required. 
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SUMMARY 


Present  practices  in  lightning  protection  of  aircraft 
deal  primarily  with  the  DIRECT  EFFECTS  of  lightning,  such  as 
structural  damage  and  ignition  of  fuel  vapors.  There  is 
increasing  evidence  of  troublesome  electromagnetic  effects, 
however,  in  aircraft  employing  solid-state  microelectronics  in 
critical  navigation,  instrumentation  and  control  functions* 

The  potential  impact  of  these  INDIRECT  EFFECTS  on  critical 
systems  such  as  Digital  Fly-by-Wire  (DFBW)  flight  controls  has 
been  studied  by  several  recent  research  programs , including  an 
experimental  study  of  lightning-induced  voltages  in  the  NASA 
F8  DFBW  airplane.  The  results  indicate  a need  for  positive 
steps  to  be  taken  during  the  design  of  future  fly-by-wire  sys- 
tems to  minimize  the  possibility  of  hazardous  effects  from 
lightning . 


INTRODUCTION 


Present  practices  in  lightning  protection  of  aircraft 
deal  predominantly  with  what  may  be  called  the  DIRECT  EFFECTS 
of  lightning,  including  burning,  blasting  and  physical  defor- 
mation of  skins  and  structural  elements.  Existing  lightning 
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protection  specifications,  such  as  MIL-B~5087B,  (Bonding, 
Electrical,  and  Lightning  Protection,  for  Aerospace  Systems) 
concentrate  on  electrical  bonding  and  its  function  in  mini- 
mizing these  effects*  Other  criteria  such  as  FAA  Advisory 
Circular  No.  AC  25-3A,  provide  guidance  for  protection  against 
lightning  ignition  of  flammable  fuel-air  mixtures.  Concern 
with  these  effects  has  been  necessary  since  safety  of  flight 
in  a lightning  environment  has  heretofore  primarily  depended 
upon  protection  against  fuel  ignition  and  structural  damage 
that  can  be  produced  by  lightning.  There  is  increasing  evi- 
dence of  troublesome  electromagnetic  effects  due  to  lightning, 
however,  as  a result  of  transient  surge  voltages  induced  in 
aircraft  electrical  wiring.  These  voltages  have  caused  both 
permanent  damage  and  temporary  malfunction  of  equipment. 


Earlier  vacuum  tube  electronics  were  inherently  less 
vulnerable  to  lightning-induced  voltage  surges;  however,  the 
newer  generations  of  modern,  solid  state  microcircuitry  are 
increasingly  more  vulnerable  to  upset  or  damage  from  such 
effects.  Because  these  are  electromagnetically  induced  ef- 
fects, they  are  often  referred  to  as  the  INDIRECT  EFFECTS  of 
lightning.  Recently,  these  effects  have  been  receiving  addi- 
tional attention  since  the  flight  safety  of  modern  aircraft  is 
increasingly  dependent  on  reliable  operation  of  critical 
electronic  systems.  At  present  there  are  no  standards  or 
specifications  applicable  to  the  INDIRECT  EFFECTS  of  lightning. 

With  the  advent  of  fly-by-wire  systems,  particularly 
those  with  digital  computer  and  control  electronics,  the  in- 
direct effects  of  lightning  very  clearly  have  the  potential  of 
presenting  a hazard  to  safety  of  flight.  This  hazard  may  be 
particularly  acute  for  digital  systems.  While  most  practical 
digital  fly-by-wire  systems  would  include  multiple  redundant 
control  circuits  it  is  possible  to  conceive  of  a situation  in 
which  the  high  level  electromagnetic  interference  produced  by 
lightning  could  interfere  with  all  channels  of  a fly-by-wire 
system  at  once,  raising  the  possibility  that  there  may  in  fact 
be  no  real  redundance  with  respect  to  lightning  effects. 

The  NASA  Flight  Research  Center  has  developed  and  is 
presently  demonstrating  a digital  fly-by-wire  (DFBW)  flight 
control  system  in  an  F8  aircraft.  Recognizing  the  possibility 
of  this  hazard,  a program  was  implemented  with  General  Electric 
to  evaluate  the  possible  electromagnetic  effects  of  lightning 
on  this  flight  control  system  and  obtain  data  for  use  in  mini- 
mizing these  effects  in  future  generations  of  fly-by-wire  air- 
craft. The  F8  DFBW  system  was  not  designed  to  withstand  light- 
ning strike  effects.  Therefore,  the  opportunity  existed  to 
experimentally  determine  the  severity  of  effects  in  this  unpro- 
tected system,  thus  providing  test  data  upon  which  to  base 
design  guidelines  for  protection  of  future  systems. 
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SYMBOLS 


A/C  Aircraft 

AGG  Apollo  Guidance  Computer  (DFCS  computer) 

BCS  Baclcup  Control  System 

DFCS  Digital  Flight  Control  System 

DFBW  Digital  Fly  by  Wire 

IR  Structural  ohmic  resistive  voltages 

i_  Lightning  current 

TEST  AND  MEASUREMENT  TECHNIQUE 

A recently  developed  simulated  lightning  test  and  measure- 
ment system  known  as  the  TRANSIENT  ANALYSIS  technique  offers  a 
means  of  investigating  the  electromagnetic  effects  of  light- 
ning without  hazard  to  the  aircraft  being  tested.  This  tech- 
nique, the  development  of  which  was  sponsored  by  the  Aerospace 
Safety  Research  and  Data  Institute  of  NASA-Lewis  Research 
Center  (Ref.  1),  consists  of  injecting  current  surges  into  an 
aircraft,  of  the  same  waveshape  as  those  produced  by  lightning 
but  of  greatly  reduced  amplitude.  The  responses  of  the  air- 
craft’s electrical  circuits  to  these  current  surges  can  be 
measured  and  then  extrapolated  to  correspond  with  full  light- 
ning stroke  amplitudes  to  determine  if  they  present  a hazard  to 
the  equipment  under  test  • During  the  development  of  this 
technique,  tests  were  made  to  show  that  the  response  of  an 
aircraft  electrical  system  was  linear  with  lightning  current 
amplitude  and  that  this  extrapolation  was  valid.  The  transient 
analysis  technique  was  utilized  in  the  study  of  the  NASA  F8 
DFBW  aircraft  in  this  program.  A photograph  of  the  aircraft 
and  test  setup  is  shown  in  Figure  1. 

The  test  circuit  is  shown  on  Figure  2(a).  The  airframe  is 
connected  to  ground  at  the  point  nearest  the  terminals  of  the 
circuit  being  measured  via  a 36  inch  wide,  3 mil  aluminum  foil. 
This  was  attached  to  the  instrument  table  and  the  hangar  ground 
about  20  feet  away.  Use  of  the  aluminum  foil  provides  a very 
low  impedance  between  the  airframe  and  instrument  table.  The 
instrument  cable  was  placed  along  this  foil  so  that  no  air  gap 
existed  between  it  and  the  foil.  As  shown  on  Figure  2(b),  the 
lightning  current  circuit  is  grounded  once  and  only  via  this 
airframe  ground  foil.  Consequently,  no  simulated  lightning 
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current  could  flow  off  of  the  airframe  along  this  path  or  the 
instrument  cable  shield  and  get  back  to  the  transient  analyzer* 

lAost  of  the  tests  were  made  with  a unidirectional  simu- 
lated lightning  stroke  current  rising  to  its  crest  in  2.75 
microseconds  and  decaying  to  half  value  after  60  microseconds. 
This  waveform  is  representative  of  natural  lightning  stroke 
waveforms  and  is  similar  to  the  waveform  specified  for  indirect 
effects  testing  of  the  Space  Shuttle . Its  crest  amplitude  was 
set  at  300  amperes  to  minimize  the  possibility  of  interference 
or  damage  to  any  of  the  electronic  systems  or  components  aboard 
the  aircraft.  Natural  lightning  strokes  exceed  200,000  amperes 
about  1%  of  the  time  and  average  about  30,000  amperes  in  ampli- 
tude. Therefore,  voltages  induced  by  this  waveform  must  be 
extrapolated  upward  by  a factor  of  100  to  correspond  with  an 
average  lightning  stroke  or  670  to  correspond  with  a severe 
200  kA  stroke.  The  test  current  waveform  is  shown  on  Figure  2a 

It  will  be  noted  that  damped  oscillations  appear  on  the 
test  current  wavefront.  These  are  believed  to  be  the  result 
of  traveling  wave  reflections  in  the  transmission  line  formed 
by  the  aircraft  and  return  conductor  beneath  it.  Measurements 
were  made  of  the  current  entering  as  well  as  leaving  the  air- 
craft, verifying  that  the  superimposed  oscillations  flowed 
through  the  aircraft  along  with  the  fundamental  current  wave- 
form. The  extent  to  which  oscillations  or  "jagged  edges"  occur 
in  natural  lightning  current  wavefronts  is  not  well  known, 
although  available  oscillographic  data  (Ref.  2)  does  show 
evidence  of  such  occurrences  in  some  strokes. 

Induced  voltages  were  measured  by  a Tektronix  Type  545 
oscilloscope  with  a Tektronix  Type  G differential  pre-amplifier 
The  differential  measurement  system  previously  developed  for 
this  technique  and  described  in  Ref.  1 was  utilized.  One 
channel  of  the  measurement  circuit  was  normally  connected  to 
the  circuit  conductor  being  measured,  and  the  other  channel  was 
connected  to  the  DFGS  ground,  airframe  ground  or  circuit  low 
side,  as  required  for  the  measurement  being  made.  The  pre- 
amplifier subtracted  the  s ignal  on  the  second  channel  from  that 
on  the  first  so  that  common-mode  errors  induced  in  the  instru- 
ment cable  would  not  appear  in  the  measurement. 

Measurements  were  made  with  the  DFBW  system  powered  with 
batteries  and  operating  in  the  primary  mode.  Access  to  most 
cir cuits  was  made  wi th  break-out  boxes  at  important  interfaces 
in  order  to  maintain  circuit  continuity , although  some  measure- 
ments were  made  at  opened  interfaces  to  obtain  measurements  of 
open-circuit  voltages  at  cable  ends. 
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DESCRIPTION  OF  DFBW  SYSTEM 


The  F8  digital  fly-by ’-wire  flight  control  systeni  compo- 
nents are  shown  in  Figure  3.  A single  digital  primary  channel 
and  triple  redundant  electrical  analog  backup  channels  replaced 
the  F8  mechanical  control  system.  The  primary  and  backup 
channels  all  provide  three-axis  control  of  the  airplane.  The 
digital  channel  consists  of  a lunar  guidance  computer,  inertial 
measurement  unit,  coupling  data  unit,  and  astronaut  display 
and  keyboard,  all  taken  from  the  Apollo  guidance  and  navigation 
system.  A mode  and  power  panel  permits  the  pilot  to  request 
the  lunar  guidance  computer  to  make  mode  and  gain  changes.  The 
three-channel  backup  control  system  consists  only  of  surface 
position  command  electronics.  Specially  designed  electro- 
hydraulic  secondary  actuators  interface  the  primary  and  backup 
electronic  commands  with  the  conventional  F8  control  surface 
power  actuators . 

Figure  4 shows  the  general  arrangem'ent  of  the  flight  con- 
trol system  hardware  in  the  F8  airplane.  Five  secondary 
actuators  were  required,  one  for  the  rudder  and  one  each  for 
the  two  horizontal  stabilizers  and  the  two  ailerons.  The  Apollo 
lunar  guidance  computer  is  the  heart  of  the  primary  control 
system  and  performs  all  flight  control  computations. 

The  DFBW  system  is  described  in  more  detail  in  Reference  3. 

TEST  RESULTS 

Measurements  were  made  at  a variety  of  primary  and  backup 
system  interfaces.  Of  greatest  interest  were  the  induced  volt- 
ages appearing  at  the  wiring  interfaces  with  the  primary  DFCS 
system,  which  includes  the  Apollo  lunar  guidance  computer  (AGC) . 
Figures  5,  6 and  7 show  some  of  the  measurements.  For  all  of 

these  measurements  the  simulated  lightning  current  entered  the 
nose  and  exited  from  the  tail  of  the  aircraft.  Figure  5 shows 
measurements  made  at  the  J25  interface  on  circuits  coming  from 
the  mode  and  power  control  panel  and  stick,  BCS  and  yaw  trim 
transducers  in  the  cockpit  area.  These  appear  as  damped  oscil- 
lations at  a fundamental  frequency  of  about  1 megahertz.  Most 
of  the  voltage  has  subsided  after  about  6 microseconds  has 
elapsed.  Each  voltage  shown  on  Figure  5 is  a damped  oscillation 
at  a fundamental  frequency  of  about  1 megahertz  since  all  con- 
ductors follow  the  same  bundle  to  the  cockpit.  The  waveforms 
have  slight  variations  which  are  probably  due  to  differences  in 
load  impedances  at  each  end. 
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Figure  6 shows  voltages  induced  in  the  pitch,  roll  and  yaw 
conttol  sensor  circuits  coming  to  the  DFCS  computer,  but  the 
measurements  were  made  at  plug  P4  with  this  plug  disconnected 
from  the  DFCS  system.  These,  therefore,  are  open  circuit  volt- 
ages and  are  not  necessarily  the  same  as  the  voltages  which 
might  appear  at  the  closed  interface,  since  DFCS  input  impedances 
would  affect  the  voltages  impressed  across  them.  The  charac- 
teristic frequencies  of  the  open-circuit  voltages  measured  at 
pins  D-E  (osc.  528),  G-H  (osc.  525),  W-X  (osc.  523)  and  Y-Z 
(osc.  526)  have  a fundamental  frequency  of  about  1.7  megahertz 
with  lower  amplitude  oscillations  of  several  higher  frequencies 
superimposed.  These  are  induced  in  circuits  coming  from  the 
DFCS  stick  transducer  in  the  cockpit.  The  fundamental  fre- 
quency of  voltages  measured  at  pins  A-B  {osc.  524)  and  U-V 
(osc.  527)  in  circuits  coming  from  the  rudder  pedal 
transducer  in  the  tail  area  is  also  1.7  megahertz  but  without 
as  much  of  the  superimposed  higher  frequency  component.  Neither 
fundamental  frequency  is  the  same  as  that  measured  at  the  closed 
J25  interface  in  circuits  also  coming  from  the  cockpit  area. 

The  closed  circuit  J2  interface  measurements  shown  on 
Figure  7 are  of  the  same  1 megahertz  fundamental  as  those  mea- 
sured at  the  J25  interface  of  Figure  5,  except  that  the  polarity 
is  reversed. 


DISCUSSION  OF  RESULTS 


Induced  Voltages 

Study  of  the  induced  voltages  measured  in  this  system  indi- 
cates that  they  are  primarily  of  aperture  magnetic  flux  origin 
due  to  the  absence  of  long-duration  unidirectional  components 
induced  by  diffusion  magnetic  flux  appearing  inside  the  airframe 
when  lightning  current  has  diffused  to  the  inside  of  its  skin. 
Indications  of  structural  IR  voltage  components  are  also  absent, 
as  expected,  since  the  system  is  single-point  grounded  and  has 
no  direct  reference  to  the  airframe  at  locations  remote  from 
the  DFCS  pallet  where  these  measurements  were  made.  The  single- 
point ground  to  the  airframe  is  at  the  DFCS  pallet. 

The  most  prevalent  frequency  of  oscillation  of  induced 
voltages  measured  at  the  DFCS  interface  is  about  1 megahertz. 
This  is  not  the  same  frequency  as  the  oscillations  superimposed 
on  the  simulated  lightning  current  wavefront,  which  is  2.6  mega- 
hertz. If  fact,  there  is  no  similarity  between  this  frequency 
and  that  of  induced  voltages  measured  anywhere  in  the  DFCS 
system*  Fourier  transformations  were  made  to  determine  the 
frequency  spectral  distribution  of  the  actual  lightning  test 
waveform  as  compared  with  an  idealized  smooth-front  waveform. 
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spectral  peaks  above  the  smooth-front  waveform  distribution 
occur  in  the  test  waveform  distribution  at  2*5,  5 and  8 mega- 

hertz, but  not  at  the  1 megahertz  frequency  of  the  induced 
voltages  measured  at  the  DFCS  interfaces. 

The  induced  voltages  reach  their  maximum  during  the  first 
several  microseconds  of  lightning  current  f low , which  is  when 
the  lightning  current  and  corresponding  aperture  flux  are 
changing  most  rapidly . Continued  oscillations  appearing  for 
several  more  microseconds  are  most  likely  the  result  of  subse- 
quent traveling  waves  in  the  circuit  being  measured . If  this 
is  so,  the  frequency  of  these  voltages  is  primarily  a function 
of  the  distributed  circuit  inductance  and  capacitances. 

The  variation  in  fundamental  frequencies  and  presence  of 
more  than  one  frequency  component  in  a single  voltage  is  prob- 
ably due  to  variations  in  circuit  routing  and  interconnections 
with  other  circuits  in  the  system. 

The  ranges  of  voltage  amplitudes  measured  at  the  DFCS 
interfaces,  when  scaled  to  a 200,000  a'mpere  (fast)  lightning 
waveform,  are  presented  in  Table  I- 

Table  I - Range  of  Induced  Voltage  Amplitudes 

(Scaled  to  i “ 200  kA) 

L 


INTERFACE 

INDUCED  voltage  AMPLITUDE 
(0  - Peak  Volts) 

MIN  . 

MA  X . 

Stick  Trim  and  MPC  Inputs  to  DECS ( J25) 

2 33 

900 

Stick  Transducer  Inputs  to  DPCS(P4) 

40 

8 7 

DFCS  Control  Outputs (J2) 

233 

400 

BCS  Control  Inputs (J12) 

222 

422 

Mode  and  Power  Control (Jl5) 

833 

113  2 

Mode  and  Power  Control (J14) 

213 

7 32 

Power  Dist,  Bay  (+28VDC  BUS) 

160 

200 

DFCS  Ground  to  A/C  Ground 

666 

Voltages  measured  at  other  locations  in  the  DFBW  system, 
such  as  at  the  secondary  actuators  and  BCS  electronics,  were  of 
generally  similar  magnitudes. 
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ImpaGt  on  DFCS  System 

The  expected  impact  of  the  induced  voltages  measured  ik  the 
DFCS  system  on  system  operation  was  analyzed  by  DELCO  Electronics^ 
manufacturer  of  the  DFCS • Comparison  of  individual  component 
vulnerability  data,  when  available,  with  induced  voltage  levels 
at  single  circuit  interfaces  was  utilized  to  determine  vulnera- 
bility of  system  components  and  effect  on  circuit  operation . In 
other  cases,  best  engineering  judgment  was  used.  An  example  of 
such  an  assessment  is  the  attitude  (yaw,  pitch  or  roll)  gain 
logic  power  circuits  (pins  A-W)  from  the  MPC  panel  to  the  DFCS 
pallet.  The  schematic  diagram  of  one  of  these  circuits  is  shown 
on  Figure  8.  Induced  voltages  at  the  J25  interface  are  shown 
on  Figure  5 (i.e.  osc.  505).  The  voltages  at  the  J25  interface 

(DFCS)  ranged  from  566  to  865  volts,  and  at  the  J15  interface 
(MPC),  1065  to  1132  volts.  At  the  MPC,  the  induced  voltage 
exceeds  the  1000  volt  (at  sea  level)  dielectric  breakdown  rating 
of  the  switch.  Arc-over  may  therefore  occur  either  to  case  and 
mounting  or  between  contacts,  with  a possibility  of  switch  fail- 
ure . 

This  circuit  (+28  VDC)  provides  a request  to  the  computer 
to  change  attitude  control  loop  gain . If  the  wiper  arm  of  the 
switch  burns  open,  the  computer  will  notice  no  gain  requests 
and  under  this  condition  is  programmed  to  assume  attitude  gain 
position  1.  The  DFCS  control  will  survive  at  this  gain  position. 
If  the  switch  would  short  such  that  two  gain-position  requests 
exist,  the  computer  is  programmed  to  assume  the  lower  gain  of 
the  two  requests.  The  DFCS  control  will  survive. 

At  the  AGC,  the  induced  voltage  exceeds  the  500  volt  dielec- 
tric breakdown  rating  of  the  20K  resistor,  R2 . Arc-over  of  R2 
may  then  expose  capacitor  Cl  to  damaging  overvoltage,  causing 
it  to  short  circuit.  If  it  remains  shorted  during  the  entire 
lightning  flash,  no  further  damage  should  occur.  If  Cl  opens 
between  successive  strokes  of  a multiple  stroke  flash , arc- 
over(s)  of  the  1.5K  resistor  R4  on  successive  strokes  may  per- 
manently destroy  transistor  Ql.  If  Cl  is  short  circuited,  the 
AGC  gain  change  circuit  will  be  inhibited . Selection  of  this 
gain  position  after  the  lightning  flash  will  cause  the  computer 
to  select  attitude  gain  position  1.  The  DFCS  control  will  sur- 
vive at  that  gain  position.  The  same  applies  if  transistor  Ql 
fails . 

As  another  example,  the  DFCS  digital  control  output  cir- 
cuits are  considered.  The  schematic  diagram  of  these  circuits 
is  shown  on  Figure  9.  Induced  voltages  measured  at  the  J2 
interface  are  shown  on  Figure  7 and  range  from  233  to  400  volts. 
Those  measured  at  the  P12  end  ranged  between  222  and  422  volts. 

At  the  DFCS,  capacitor  C2  has  a 15V  rating.  Therefore  it  would 
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break  down  as  a short  circuit.  The  capacitor  could  then  fail  as 
an  open  circuit.  In  either  case  the  remaining  circuit  compo- 
nents would  probably  survive  the  lightning  stroke . These  are 
dual  c-ircuits  which  provide  attitude  commands  which  are  util  ized 
as  contrql  surface  inputs . The  dual  outputs  are  compared  to 
each  other  for  failure  detection  purposes  * S ince  capacitor  C2 
can  be  failed  as  an  open  or  short  circuit , several  combinations 
were  considered.  If  C2  is  shorted  as  a dual  output,  no  failure 
detection  would  occur.  The  pilot  would  discover  that  a problem 
existed  only  by  noting  the  lack  of  aircraft  response  to  control 
stick  position.  If  one  of  the  dual  command  outputs  contained 
C2  open  circuited  and  the  other  short  circuited,  any  off -neutral 
control  stick  position  would  trigger  the  failure  detection 
circuit  which  would  remove  that  attitude  axis  control  from  DPCS 
to  the  BCS , In  the  case  of  C2  open-circuted  as  a dual  output, 
DFCS  aircraft  attitude  control  could  be  maintained. 

Other  individual  circuits  were  assessed  in  the  same  manner » 
Failure  in  some  circuits  is  likely  to  degrade  DFCS  performance, 
but  in  others,  the  consequences  appear  minimal.  It  is  evident, 
from  Figures  5,  6 and  7,  that  1 ightning- induced  voltages  appear 

simultaneously  in  all  DFCS  circuits , 

They  also  appeared  in  the  3 BCS  channels.  Thus,  the  con- 
sequences of  simultaneous  failures  in  many  circuits  must  be 
fully  assessed  before  the  total  impact  on  system  operation  can 
be  determined.  This  has  not  been  accomplished  for  this  system. 

In  general,  however,  it  was  found  that  many  DFCS  components 
are  vulnerable  to  the  induced  voltages  expected  from  a 200,000- 
ampere  lightning  stroke.  The  most  vulnerable  components  are 
capacitors,  transistors,  and  relay  arc-suppression  diodes. 

The  least  vulnerable  components  that  may  be  damaged  are  switches, 
relays,  forward  loop  diodes,  and  inductors. 

It  should  be  remembered  that  the  DFCS  equipment  is  an 
adaption  of  existing  Apollo  Lunar  Module  equipment  that  was  not 
designed  to  survive  1 ightning- induced  voltages,  and  also,  that 
a 200,000  ampere  stroke  is  likely  to  occur  only  about  1%  of  the 
time.  The  average  amplitude  is  about  30,000  amperes.  Under 
this  condition,  component  vulnerability  is  reduced. 
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CONCLUSIONS 


This  program  represents  the  first  experimental  investi- 
gation of  lightning-induced  effects  on  a fly-by-wire  system, 
digital  or  analog.  The  results  of  this  study  are  therefore 
significant,  both  for  this  particular  aircraft  and  for  future 
generations  of  aircraft  and  other  aerospace  vehicles  such  as 
the  Space  Shuttle,  which  will  employ  digital  fly-by-wire  flight 
control  systems.  Particular  conclusions  from  this  work  are  as 
follows: 

1.  Equipment  bays  in  a typical  metallic  airframe  are  poorly 
shielded  and  permit  substantial  voltages  to  be  induced 
in  unshielded  electrical  cabling  inside. 

2.  Lightning-induced  voltages  in  a typical  aircraft  cabling 
system  pose  a serious  hazard  to  modern  electronics,  and 
positive  steps  must  be  taken  to  minimize  the  impact  of 
these  voltages  on  system  operation. 

3.  Induced  voltages  of  similar  magnitudes  will  appear 
simultaneously  in  all  channels  of  a redundant  system. 

4.  A single-point  ground  does  not  eliminate  lightning-induced 
voltages.  It  reduces  the  amount  of  diffusion-flux  induced 
and  structural  IR  voltage  but  permits  significant  aperture- 
flux  induced  voltages. 

5.  Cable  shielding,  surge  suppression,  grounding  and  interface 
modifications  offer  means  of  protection,  but  successful 
design  will  require  a coordinated  sharing  of  responsibility 
among  those  who  design  the  interconnecting  cabling  and  those 
who  design  the  electronics.  A set  of  Transient  Control 
Levels  for  system  cabling  and  Transient  Design  Levels  for 
electronics,  separated  by  a margin  of  safety,  should  be 
established  as  design  criteria.  Data  from  this  and  other 
experimental  programs  should  be  utilized  to  help  establish 
the  s e criteria. 
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FIGURE  1 - TEST  SETUP  FOR  MEASUREMENT  OF  L I GHTN I NG- I NDUCED 

VOLTAGES  IN  NASA  F8  DFBW  AIRPLANE. 


Simulated  Lightning  Current 
300  Amperes  Peak 


Instrument 

Table 


a)  Actual  Test  Circuit 


b)  Equivalent  Test  Circuit 


FIGURE  2 


SIMULATED  LIGHTNING  WAVEFORM  AND  TEST 
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FIGURE  3 - F-8  DIGITAL  FLY-BY-WIRE  CONTROL  SYSTEM  HARDWARE  ELEMENTS 
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FIGURE  6 - INDUCED  VOLTAGES  ON  CONTROL  SENSOR  INPUTS  TO  DFCS  AT  P4(0PEN) 
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FIGURE  7 - INDUCED  VOLTAGES  ON  DFCS  DIGITAL  CONTROL  CIRCUITS  AT  J2  INTERFACE. 
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J15  Interface 
egaverage  = 1119 

range  = 1065  to  1132  V 
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f = 1 .0  MHz 

No. of  measurements  - 5 
(J15:  Yaw  & Roll  Gain  4; 
Not  Shown  in  Figures) 


J25  Interface 
ej^average  = 677 


ejj  range  = 566  to  865  V 


f = 1.0  MHZ 


No. of  measurements  = 3 
(J25:  Yaw,  Pitch  & Roll 
Gain  4 - Fig. 6,  osc.  505, 
500,502) 


FIGURE  8 - ATTITUDE  GAIN  SWITCH  POSITION  2,  3,  and  4 
SIGNAL  CIRCUIT  FOR  DFCS  AND  MPC  INTERFACE. 
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6a  average  = 316 
6g  range  - 233  to  400 
f - 1 .0  MHz 

No. of  measurements  = 6 
(J2:  Yaw,  Pitch  and  Roll 
DACS'  1 and  2,  Figure  7) 


ejj  average  = 355 


ejj  range  = 222  to  422V^Q_p^ 


1 = 1.0  MHz 


No.  of  measurements  = 3 
(Yaw,  Pitch  and  Roll 
p r i m a r y c omma n d s ) 


FIGURE  9 - DFCS  DIGITAL  CONTROL  DIGITAL-TO  ANALOG 
CONVERTER  OUTPUT  SIGNAL  CIRCUIT  TO 
PRIMARY  CONTROL  ELECTRONICS. 
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REDUNDANCY  OF  HYDRAULIC  FLIGHT  CONTROL  ACTUATORS 


C . C . Chenoweth  and  D.  R.  Ryder 
Boeing  Commercial  Airplane  Company 


SUMMARY 


The  constraint  of  requiring  airplanes  to  have  inherent  aerodynamic 
stability  can  be  removed  by  using  active  control  systems.  The  resulting  air- 
plane requires  control  system  reliability  approaching  that  of  the  basic 
airframe.  Redundant  control  actuators  can  be  used  to  achieve  the  required  reli- 
ability, but  create  mechanization  and  operational  problems.  Of  numerous 
candidate  systems,  tvo  different  approaches  to  solving  the  problems  associated 
with  redundant  actuators  appear  the  most  likely  to  be  used  in  advanced  airplane 
control  systems. 


INTRODUCTION 


Future  civil  aircraft  will  have  to  take  advantage  of  all  possible  gains 
in  aerodynamic  efficiency  and  weight  reduction  to  be  economically  viable.  It 
has  been  shown  in  previous  studies  by  Boeing  and  others  that  gains  in  aero- 
dynamic efficiency  and  reduction  in  airplane  weight  can  be  achieved  by  placing 
the  center  of  gravity  aft  of  the  longitudinal  maneuver  point.  The  resulting 
unstable  airplane  must  be  augmented  through  the  flight  control  system  to  pro- 
vide acceptable  handling  qualities.  If  the  stability  of  the  airplane  is 
critical,  such  that  loss  of  the  augmentation  would  result  in  loss  of  the  air- 
plane, the  control  system  reliability  must  approach  that  of  the  basic  airframe. 
To  meet  this  level  of  reliability,  special  consideration  must  be  given  to  the 
control  system  design.  Such  considerations  Include  design  simplification, 
derating  of  components,  elimination  of  electrical  connectors,  and  physical  iso- 
lation of  electrical  wiring  and  hydraulic  power.  Even  then  redundancy  is 
usually  required  to  obtain  satisfactory  reliability  from  the  complex  hydraulic 
actuators  and  electronic  control  systems  used  in  airplane  flight  controls. 

Use  of  redundancy  to  achieve  reliability  has  always  been  an  accepted 
engineering  design  technique.  However,  the  advantages  of  redundancy  are  not 
easily  realized  in  control  systems  because  of  signal  channel  interaction, 
failvure  effects,  performance  degradation  after  failures,  null  shift  with  chan- 
nel switching  and  failure  detection  problems.  If  force  voted  multiple  hydraulic 
actuators  are  used  to  drive  a single  load,  actuator  load  sharing  also  becomes 
a concern.  Methods  of  insuring  proper  load  sharing  can  reduce  load  reaction 
stiffness,  cause  poor  resolution,  and  may  lead  to  dynamic  instability  if  not 
properly  designed  and  built.  Monitoring  used  to  effect  the  orderly  shutdown 
of  failed  elements  may  cause  inadvertent  shutdown  of  good  elements.  All  of 
these  problem  areas  with  respect  to  redundant  control  systems  and  actuators 
require  careful  consideration  in  control  system  design  and  mechanization. 
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REDUNDANCY  REQUIRENEHTS 


Redundancy  requireinients  for  flight  control  actuation  systems  can  be 
divided  into  two  areas,  the  requirement  for  flutter  free  control  surfaces  and 
the  maintenance  of  critical  control  surface  operation. 

The  need  to  minimize  airplane  weight  reduces  the  penuissible  use  of 
control,  surface  mass  balance  as  a means  of  preventing  control  stxrface  flutter. 
If  mass  balance  is  not  used,  the  svirface  must  be  restrained  by  the  surface 
control  system.  The  Federal  Aviation  Regulations,  Voltane  III,  Part  25, 
paragraph  25*629,  ”Flutter,  deformation,  and  fail-safe  criteria,”  requires 
that  an  airplane  be  free  from  flutter  after  any  single  failure  in  the  flight 
control  system,  plus  any  other  "reasonably  probable”  single  failure  or  mal- 
function affecting  flutter.  Hydraulic  system  failures  are  classified  as 
"reasonably  probable”  by  the  PAA.  Therefore,  when  airplane  design  dictates 
that  control  surfaces  be  restrained  by  the  surface  power  actuators  to  avoid 
the  mass  balance  weight  penalty,  these  requirements  dictate  a need  for  at 
least  two  surface  power  actuators  and  three  hydraulic  systems  for  each  surface. 

Independent  of  considerations  for  suppression  of  surface  flutter,  surface 
power  actuator  redundancy  is  also  Influenced  by  the  need  to  maintain  control 
of  the  airplane  flight  path.  The  Federal  Aviation  Regulations,  Volume  III, 
Part  25,  paragraph  25* 671*  requires,  in  part,  that  the  airplane  must  be  cap- 
able of  safe  flight  and  landing  after  any  single  failure,  excluding  Jamming, 
in  combination  with  any  probable  hydraulic  or  electrical  system  failure. 

One  form  of  redundancy  to  assure  continuance  of  control  function  would 
be  to  use  multiple  aerodynamic  surface  segments,  independently  controlled, 
in  each  airplane  axis.  If  actuator  redundancy  were  not  required  for  pre- 
vention of  flutter,  each  surface  could  be  controlled  by  a single  actxiator. 
Degraded,  but  safe,  operation  would  be  possible  if  one  or  more  surface  seg- 
ments became  inoperable.  This  feature  is  used  in  some  current  airplanes. 
However,  if  the  airplane  design  is  such  that  a limited  number  of  flight 
control  surfaces  are  available  or  if  all  control  surfaces  in  an  axis  are 
needed  for  flight  path  control,  each  surface  must  remain  controllable  after 
certain  dual  control  system  failures. 

Advanced  supersonic  airplanes  will  probably  be  limited  in  use  of  control 
surface  redundancy,  paarticularly  in  the  longitudinal  axis,  because  of  the  need 
to  attain  maximum  aerodynamic  efficiency.  The  need  for  minimum  weight  in  an 
advanced  supersonic  transport  airplane  will  also  limit  the  consideration  of 
mass  balance  for  flutter  prevention.  These  two  factors  are  sufficient  to  set 
the  minimum  red\mdancy  level  for  surface  power  actuators  and  show  the  need 
for  redvindancy  in  flight  control  actuation  systems. 
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ACTUAIOR  REDUNDANCY  MECHANIZATION 


There  axe  two  distinct  categories  of  mechanization  applied  to  redundant 
actuator  channels  used  in  aircraft  control  systems.  One  type  is  the  parallel 
active  configvtration,  and  the  other  type  is  the  active/ standby  configuration. 
The  principle  differences  between  the  two  types  are  as  follows: 

a.  Since  the  parallel  active  technique  implies  that  the  control  channels 
are  working  together  at  some  point  in  the  control  system,  the  failure  of  one 
of  the  control  channels  can  cause  an  output  performance  change.  For  an 
active/standby  system,  the  control  elements  operate  independently  and  failures 
of  the  active  control  element  causes  transfer  to  a correctly  operating  standby 
channel  with  no  performance  degradation* 

b.  With  a parallel  active  system  all  of  the  control  channels  are  working 
at  the  same  time  and  the  fail\u*e  of  one  channel  is  compensated  for  by  the 
remaining  correctly  operating  channels  (to  varying  degrees) . It  is  not  neces- 
sary to  rapidly  switch  the  failed  channel  off.  With  an  active/standby 
mechanization,  rapid  transfer  between  control  elements  is  essentied  (with  the 
actual  required  transfer  time  being  determined  by  the  particular  application). 

There  are  three  options  available  in  mechanization  of  parallel  active 
systems.  The  control  channels  can  be  brought  together  and  the  actuator  out- 
puts summed  in  the  following  ways: 

a.  Force  voting 

b . Velocity  summing 

c . Position  summing 

Force  voting  is  the  most  common  technique  used  in  mechanizing  parallel 
active  systems.  By  force  voting  several  actuators  on  a common  output,  an 
output  representing  the  mid  value  of  all  input  commands  can  be  achieved.  Many 
examples  of  this  type  of  system  exist.  The  Boeing  7^7  pitch  and  roll  autopilot 
actuators  (autoland  option),  and  the  GE  680J  F-4  roll  and  yaw  secondary  actu- 
ators are  typical.  One  problem  with  this  type  of  system  that  does  not  exist 
with  other  types  is  the  force  fight  that  can  occur  between  acttiator  channels 
when  channels  differ  in  input  comnand  or  actuator  characteristics. 

Velocity  siaaming  is  an  alternate  parallel  active  meclumization  which  does 
not  incur  the  force  fight  problems  of  the  force  voted  systems.  Probably  the 
best  example  of  this  method  is  the  electromechanical  secondairy  actuator  devel- 
oped by  LTV  for  the  680J  F-U  pitch  axis.  This  mechanization  uses  servo  motors 
summed  through  differential  gear  boxes.  Net  output  velocity  is  the  sum  of 
the  individual  motor  velocities  and  the  force  output  is  the  sum  of  the 
individual  force  outputs  of  the  servo  motors. 

Position  stumning  systems  have  no  actuator  force  fight.  However,  since 
the  individual  actuators  are  summed  by  differential  linkage,  a channel  failure 
or  actuator  shutdown  will  reduce  total  output  stroke  capability.  Each  indi- 
vidual actuator  must  have  a larger  stroke  than  the  minimum  allowable  output 
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stroke  to  accommodate  channel  failures,  'Phis  characteristic  restricts  the 
application  of  the  position  summing  technique  to  systems  that  require  only 
small  output  displacement.  It  has  heen  used  in  dual  systems  for  series 
actuation.  Examples  are  the  Boeing  737  dual  yaw  damper  and  the  dual  channel 
series  actuators  on  the  Grumman  F-lU.  Mechanization  becomes  difficult  when 
more  than  two  actuators  are  summed  because  of  linkage  complexity. 


ACTUATOR  REDUNDANCY  IMPLEMENTATION  FACTORS 


There  are  several  factors  that  must  be  considered  when  redundant 
actuators  are  used,  The  most  significant  are  those  that  affect  normsil  opera- 
tion, operation  after  failures,  said  cause  interface  problems.  These  are 
outlined  below. 

Failure  InsensitlYity 


Failure  insensitivity  is  the  ability  of  a redundant  control  system  to 
experience  failures  and  automatically  continue  operation  with  an  acceptable 
transient.  If  the  system  performs  a critical  function,  operation  must  be 
maintained  in  the  presence  of  one  or  more  failures;  i.e.,  be  fail  operational. 
However,  a fail  operational  system  does  not  insure  minimum  control  system 
trsoisients.  The  criticality  of  transients  has  an  impact  on  the  detail  design 
of  the  system.  All  four  methods  of  redundancy  mechanization  can  be  fail 
operational.  However,  the  number  of  channels  required  and  failure 
characterisitcs  vary  as  discussed  below: 

a.  Fail-operational  capability  csn  be  achieved  in  parallel  active 
systems  by  majority  voting  or  averaging  three  or  more  active  actuators. 

With  three  active  channels  operation  continues  after  the  first  failure.  With 
four  channels  operation  continues  after  two  failures.  In  voting  systems  the 
first  failed  channel  must  be  disconnected  before  the  second  channel  fails 
for  the  system  to  remain  operational.  In  the  force  voted  systems  the  failed 
channel  is  automatically  overpowered  by  the  remaining  channels  and  the  mag- 
nitude of  the  failure  transient  can  be  insignificant.  Displacement  and 
velocity  sianming  provide  an  averaged  output  but  have  inherent  failure  tran- 
sients and  steady  state  null  offset  after  failure.  The  magnitude  of  the 
treuisients  is  dependent  upon  the  system  closed  loop  response. 

b.  With  active/standby  systems  a failure  detection  device  must  assess 
that  the  active  channel  has  failed,  automatically  disconnect  it,  and  switch 
to  a good  channel.  The  failure  transient  is  dependent  upon  the  failure 
detection  level,  the  switching  time  and  the  tracking  of  the  standby  channel. 

Failure  Detection 


Detection  and  indication  of  failures  during  operation  must  be  provided 
so  that  failed  channels  or  actuators  can  be  disengaged  to  preserve  the  integ- 
rity of  the  system.  The  fail:ire  detection  system  must  be  designed  to  detect 
all  types  of  failures;  hardover,  passive,  and  oscillatory  and  slowovers  or 
ramps  which  could  produce  an  vuisafe  situation. 
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The  ability  of  the  failure  detection  system  to  sort  out  legitimate 
failures  from  apparent  failures  which  might  occur  due  to  adverse  tolerances 
has  an  equivalence  in  reliability.  If  the  failure  detection  systen  trips  a 
channel  off  inadvertently  due  to  an  apparent  failure , the  equivalent 
mean-time-between»*failure  (MTBP)  for  the  system  may  be  significantly  affected. 

Failures  in  parallel  active  systems  may  be  sensed  by  in-line  monitoring 
of  actiiator  characteristics  or  by  cross  channel  monitoring  between  active 
actuators.  A method  of  reducing  the  number  of  redundant  actuators  is  to  add 
a model  of  a working  channel  and  use  it  for  cross  channel  monitoring.  While 
this  extends  the  system  fail  operational  capability  with  one  less  working 
channel,  its  effectiveness  depends  on  how  well  the  model  matches  the  actual 
hardware.  In  certain  applications,  where  actuators  are  large  and  where  weight 
is  critical,  the  model  approach  may  provide  a way  to  minimize  the  overall 
weight. 

In  active/standby  systems  each  channel  must  be  individually  monitored  for 
failure  detection.  Each  control  channel  is  usually  duplicated  or  modeled  to 
provide  the  comparison  required  to  detect  failure  of  the  active  channel. 

Load  Sharing 

Load  sharing  is  a measure  of  the  ability  of  multiple  actuators  with 
identicGd  inputs  to  work  together  in  positioning  a common  output.  Load  sharing 
is  a problem  peculiar  to  force  voted  actuators  since,  obviously,  there  is  no 
force  fighting  in  an  active/ standby  system  when  only  one  system  controls  at  a 
time,  or  in  position  summed  and  rate  summed  systems  where  forces  of  individual 
actuators  are  additive. 

Ideally,  it  is  desirable  that  the  load  be  divided  equally  among  redundant 
actuators  to  eliminate  any  force  fighting.  However,  tracking  errors  arise  due 
to  tolerance  buildup  in  each  actuator  servo  loop  and  actuator  installation 
that  tend  to  make  each  actuator  seek  a \jnique  position  even  though  the  input 
commands  are  identical . With  the  actuators  tied  to  a common  output  all  posi- 
tion commands  cannot  be  satisfied  and  force  fight  occurs  between  actuators. 

To  minimize  the  force  fighting  in  force  voted  actuator  configurations  and 
assure  acceptable  sharing  of  the  load,  four  methods  are  commonly  used; 

a.  Acc\irate  tolerance  control  of  the  feedback  loop  of  the  actuator. 

A mechanical  actuator  can  be  mechanized  with  good  tolerance  control  because 
of  the  manufacturing  accuracies  that  are  possible  and  the  unchanging  nature 
of  the  mechanical  linkages. 

An  electrically  controlled  actuator  has  command  path  elements  such 
as  summing  amplifiers,  demodulators,  and  feedback  transducers  which  can  change 
characteristics  with  time,  temperature,  and  power.  It  is  generally  accepted 
that  the  tolerances  associated  with  an  electronically  controlled  actuator  are 
significantly  greater  than  for  a mechanically  controlled  actuator. 
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b.  Conpliance  between  channels.  In  some  applications  the  structural 
compliance  between  actuators  allows  sufficient  individual  actuator  position 
difference  to  reduce  force  fight  through  the  normal  position  feedback  loop, 

c.  Low  force  gain  actuators.  Low  pressure  gain  servovalves  can  be  used 
to  reduce  the  force  fight  resulting  from  expected  valve  commeuad  differences 
to  an  acceptable  level.  In  some  applications  a feedback  path  consisting  of 
deflections  of  the  actuators'  reaction  structure  has  been  sufficient  to  pro- 
vide the  actuator  force  gain  reduction*  and  reduced  force  fight.  Another  way 
to  reduce  actuator  force  gain  is  to  use  actuator  pressure  as  a feedback 
command.  However,  there  is  a limit  to  the  amount  of  compliance  that  can  be 
tolerated  without  reducing  the  overall  actuator  stiffness  below  the  minimum 
allowable  level.  Reducing  actuator  force  gain  (stiffness)  has  been  used 
successfully  where  the  inputs  are  reasonably  matched*  such  as  a set  of  sur- 
face power  actxiators  signalled  by  a common  mechanical  command,  or  in  secondary 
actuators  where  the  output  load  is  small. 

d.  Equalization  to  average  load.  For  cases  where  the  actuators  are 
required  to  operate  into  large  aerodynamic  loads  and  have  \ancontrolled  input 
mismatch*  any  pressure  feedback  system  requires  modification  to  be  useful. 

The  individual  actuator  load  must  be  compared  to  the  average  load.  Computation 
of  the  average  load  and  the  individual  difference  from  average  requires  cross 
channel  comparison.  This  method  does  not  degrade  actuator  stiffness  but  adds 
complexity  auid  introduces  the  possibility  of  cross  chaunnel  failures. 

Input  Mismatch 

Differences  in  commeuids  (input  mismatch)  due  to  tolerances  in  an 
electrical  control  system,  from  sensor  to  actuator,  can  be  quite  high*  as 
much  as  a quarter  of  full  scale  command*  \inless  some  design  precautions  are 
taken  to  prevent  such  buildup.  It  should  be  noted  that  differences  in  com- 
mands generated  by  actuator  loop  tolerances  are  an  order  of  magnitude  less 
theua  those  generated  by  computational  elements  in  the  upstream  portions  of 
the  system.  The  various  methods  of  redundant  actuator  mechanization  deal 
with  the  input  mismatch  problem  as  itemized  below, 

a.  Force  Voting  Systems.  In  force  voted  systems  the  output  is  the  mid 
value  of  all  input  commands.  The  force  fight  that  occurs  due  to  input  com- 
mand mismatch  can  be  reduced  by  the  same  methods  used  to  instire  load  sharing. 

In  some  applications  the  only  possible  means  of  controlling  command  differ- 
ences may  be  the  use  of  electronic  signal  conditioning  to  reduce  the  input 
mismatch. 

b,  Velocity  Stunming  Systems,  Velocity  summed  actuators  allow  the 
individual  channels  to  cancel  command  differences  by  differentially  sxunming 
rates. 


c.  Position  Summing  Systems,  Position  summed  actuators  give  a single 
output  which  is  the  average  of  the  input  commands. 
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d.  Active/Standby  Systems.  Usually  the  active  actuator  is  commanded 
by  a single  electronic  channel  and  mismatch  is  of  no  concern  during  operation. 
Mismatches  between  the  commands  of  the  active  and  the  standby  channel  are  of 
concern*  however,  and  must  be  minimized  to  avoid  large  surface  transients 
upon  switching  from  active  to  standby  actuators. 


SECONDARY  ACTUATORS 


Surface  actuator  input  signals  can  be  either  electrical  or  mechanical. 

A dual  load  path  mechanical  signal  to  three  power  actuators  can  satisfy  all 
reliability  req.uirements.  However,  the  control  signals  for  critical  stability 
augmentation  or  fly-by-wire  systems  will  be  electrical. 

The  power  associated  with  the  electronic  signals  for  fly-by-wire  command, 
autopilot,  and  stability  augmentation  systems  must  be  kept  at  low  levels  as 
a matter  of  good  design.  These  low  level  signals  are  required  to  command  sur- 
face actuators  that  operate  at  high  power  levels.  To  transform  the  electrical 
commands  to  surface  displacements  controlled  by  large  hydratilic  power  actuators 
requires  several  stages  of  amplification.  Review  of  current  redundant  flight 
control  actuation  systems  shows  an  almost  universal  use  of  small  electrically 
signaled  hydraulic  actuators  as  one  of  the  stages  of  amplification.  These 
small  actuators  are  termed  secondary  actuators. 

It  is  advantageous  to  treat  the  command  path  and  computation  and  power 
actuation  errors  independently  by  inserting  a synchronizing  stage  between  the 
two  functions.  The  synchronizing  stage  provides  a single  valued  command  and 
may  be  an  electronic  voter  or  a mechanical  output  of  a secondary  actuator 
arrangement.  Some  of  the  advantages  of  synchronizing  are; 

a.  When  surface  power  actuators  are  isolated  from  the  upstream  command 
differences,  the  task  of  providing  adequate  power  actuator  load  shsuring 
becomes  easier,  permitting  a simpler  and  more  reliable  mechanization, 

b.  When  secondary  actuators  are  used  to  provide  the  synchronizing  stage 
they  do  not  eliminate  the  problems  of  redundant  actuators  but  the  magnitude 
of  the  problems  are  less  severe  because  the  secondary  actuators  operate  at 
significantly  lower  force  levels  than  the  surface  power  actuators. 


SYSTEM  SELECTION 


Four  types  of  actuator  redundancy  have  been  discussed.  It  has  also  been 
shown  that  prevailing  control  system  designs  use  secondary  act;iators  as  a 
stage  of  signal  amplification  and  as  a means  of  command  path  synchronization. 
Surface  power  actuators  are  usually  force  voted  mechanical  input  actuators. 
The  system  differences  are  in  the  redundancy  mechanization  of  the  secondary 
actuators.  Active/standby  and  force  voted  systems  predominate  by  a large 
margin  with  force  voted  systems  the  most  common. 
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Although  the  use  of  velocity  summing  solves  the  problem  of  force  fight 
there  are  disadvantages  vhich  msike  this  type  of  system  a questionable  candi- 
date for  future  use  in  critical  flight  control  applications  on  civil  aircraft. 
The  complex  gearing  could  make  it  difficult  to  prove  that  jam-type  failures 
would  be  extremely  remote,  as  required  by  FAA  regulations.  Also,  for  the  same 
output  force  the  electromechanical  actuator  is  larger  and  heavier  than  an 
equivalent  elect rohydraulic  actuator.  One  advantage  would  be  the  availability 
of  four  independent  actuator  signals  in  an  airplane  with  only  three  hydraulic 
signals.  Another  advantage  for  military  aircraft  is  the  reduced  vulnerability 
to  loss  of  hydraulic  systems. 

Position  summed  systems  are  difficult  to  mechanize  for  more  than  two 
redundant  channels  because  of  the  complex  linkage  required.  In  addition  the 
loss  of  rate  and  travel  capability  after  failure  and  the  inherent  output 
position  transient  that  occurs  with  failure  are  also  disadvantages. 

The  active/standby  and  the  force  voted  systems  have  advantages  and 
disadvantages  that  must  be  considered  in  conjiinction  with  the  specific  air- 
plane and  control  system  application.  Tha  most  significant  differences 
between  the  two  types  of  systems  are; 

Normal  Performance 

The  single  channel  operation  of  the  active/standby  system  can  give 
optimian  performance.  In  the  force  voted  system  residual  actuator  force  fight 
can  affect  output  resolution  and  reduce  actuator  stiffness, 

i 

Failiire  Transients 


Force  voted  systems  can  be  mechanized  to  give  very  small  failure 
transients.  The  active/standby  system  must  trade  failure  detection  levels 
and  nuisance  trips  against  the  allowable  failiire  transient. 

Performance  After  Failure 


The  active  standby  systems  preserve  normal  performance  in  the  failure 
sequence  from  the  active  channel  to  the  standby  channel  and  on  to  the  second 
standby  channel.  The  force  voted  system  may  suffer  a performance  degradation 
as  it  fails  down.  This  degradation  can  be  exhibited  as  reduced  resolution 
capability  and  force  output. 

Failure  Detection 


The  active/standby  concept  requires  immediate  failtire  detection  to  be 
safe  following  failures.  The  force  voted  concept  does  not  require  immediate 
detection  of  a failure  to  be  safe.  Failure  detection  is  only  required  to 
enable  a failed  channel  to  be  shut  down  before  another  failure  occurs. 

Switching 

Each  standby  channel  must  be  continually  monitored  to  assure  that  it  is 
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capable  of  control  if  the  active  channel  fails.  Further,  somewhere  in  the 
system  a device  like  a switch  or  blocking  valve  is  required  to  operate  with- 
out prior  knowledge  of  its  condition  to  provide  a successful  transfer  to  a 
standby  channel.  Force  voted  systems  are  comprised  of  only  active  channels 
continually  monitoring  each  other  and  require  no  inmediate  switching  to  be 
safe. 


CONCLUDING  REMARKS 


Advanced  technology  airplanes  will  require  redundant  flight  control 
actuators  to  achieve  reliability  because  operational  stability  augmentation 
system  will  be  essential  for  safe  flight  and  acceptable  airplane  handling 
qxialities. 

Surface  restraint  to  meet  the  fail  safe  requirements  for  flutter 
prevention  and  minimum  safe  controllability  requirements  will  dictate  ,the 
minimum  redundancy  levels  for  control  surface  power  actuators.  Airplanes 
with  redundauit  flight  control  surfaces  may  have  dual  surface  power  actuators 
if  a third  hydraulic  system  is  provided.  Control  surfaces  that  are  critical 
for  control  fxmctions  will  require  at  least  three  actuators  per  sxirface  in 
order  to  meet  FAA  requirements  and  provide  an  adequate  level  of  safety. 

Reliability  requirements  for  control  systems  that  amplify  autopilot, 
stability  aiigmentation,  and  pilot  commands  and  provide  inputs  to  the  control 
surface  power  actuators  are  determined  by  the  need  to  remain  operational  in 
spite  of  control  channel  malftmctions . Actuation  systems  with  fault  cor- 
rective capability  that  will  meet  the  system  reliability  requirements  and 
satisfy  FAA  regulations  require  at  least  four  active  channels  or  three  mon- 
itored channels.  Svirface  power  actuators  could  be  mechanized  with  this  level 
of  redundancy  but  it  has  been  found  to  be  more  efficient  to  utilize  small 
secondary  actuators  to  provide  a reliable  single  valued  mechanical  input  to 
three  surface  power  actuators  of  reduced  complexity. 

Based  on  a review  and  examination  of  current  redundant  actuation  systems, 
two  concepts  were  found  to  be  representative  of  secondary  actuator  mechani- 
zation which  meet  advanced  civil  airplane  flight  control  system  requirements. 
The  two  actuator  configurations  are  a foixr  channel  force  voted  system  and 
a three  channel  active /standby  system.  Both  of  these  systems  should  be 
considered  since  they  reflect  different  design  philosophies. 

Redundant  control  systems  have  operating  and  failure  characteristics  that 
are  affected  by  overall  control  system  and  airplane  design.  Redundant  actua- 
tors should  be  studied  in  conjunction  with  pilot  and  airplane  to  understand 
pilot  reaction  and  airplane  response  to  variations  in  control  system  charac- 
teristics and  failures. 
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SUMMARY 


Needed  criteria  for  active  control  technology  applications  in  commeroial 
transports  are  lacking.  Criteria  for  redundancy  requirements,  believed  to  be 
consistent  with  certification  philosophy,  are  postulated  to  afford  a discussion 
of  the  relative  value  of  multiple  control  surfaces.  Hlhe  control  power  and 
frequency  bandpass  requirements  of  various  active  control  technology  applica- 
tions are  shown  to  be  such  that  multiple  control  surfaces  offer  advantages  in 
minimizing  the  hydraulic  or  auxiliairy  power  for  the  control  surface  actuators. 


INTRODUCTION 


OPhere  is  a dearth  of  criteria  to  aid  in  the  design  of  flight  control 
systems  for  commercial  transport  aircraft  which  include  active  control  tech- 
nology (act)  applications.  Such  criteria  are  necessary,  however,  to  permit  an 
orderly  design  development  without  fear  of  costly  redesign,  as  might  resijlt 
from  special  conditions  imposed  after  the  aircraft  design  was  committed  to  take 
advantage  of  ACT.  The  Federal  Air  Regulation  for  transport  aircraft,  amendment 
25-23,  sets  forth  a number  of  failure  tolerance  requirements  for  flight  control 
systems.  Paragraph  25.671(C)  states,  ’’the  airplane  must  be  shown  by  analysis, 
test,  or  both,  to  be  capable  of  continued  safe  flight  and  landing  after  any  of 
the  following  failures  or  jamming  in  the  fli^t  control  system  and  surfaces... 

1)  Any  single  failure,  excluding  jamming...  2)  Any  combination  of  failures  not 
shown  to  be  extremely  improbable,  excluding  jamming...  5)  Any  jam... unless  the 
jam  is  shown  to  be  extremely  improbable,  or  can  be  alleviated.”  Paragraph 
25.672  says,  ”If  the  functioning  of  stability  augmentation  or  other  automatic... 
system  is  necessary  to  show  compliance  with  the  flight  characteristics  require- 
ments of  this  Part,  such  systems  must  comply  with... the  following*  a)  A 
warning. . .must  be  provided  for  any  failure.. .which  could  result  in  an  unsafe 
condition  if  the  pilot  were  not  aware  of  the  failure...  b)  The  design. . .must 
permit  initial  counteraction  of  failures... by  either  deactivation  of  the 
system... or  by  overriding  the  failure  by  movement  of  the  flight  controls  in  the 
normal  sense...  c)  It  must  be  shown  that  after  any  single  failure... the  aircraft 
is  safely  controllable... at  any  speed  or  altitude  within  the  approved  operating 
limitations...” 

These  regulations,  while  not  known  to  be  written  with  active  control  tech- 
nology applications  in  mind,  may  well  cover  the  subject.  Certainly,  ACT  appli- 
cations will  not  have  less  demanding  requirements.  Considerations  of  opera- 
tional, maintenance  and  cost  aspects  of  potential  system  redundancy  approaches. 
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necessary  to  meet  these  failure  tolerance  requirements,  leads  to  the  oonolusion 
that  split  surfaces  offer  unique  advantages  in  mechanizing  many  ACT 
applications. 


POSTULATEID  CRITERIA 


In  the  absence  of  specific  regulatory  requirements,  failure  criteria  which 
are  believed  to  be  consistent  with  certification  philosophy  are  postulated  and 
presented  in  table  1.  Por  each  ACT  application  function  the  failure  require- 
ments for  the  flight  control  system,  under  the  heading  of  Redundancy,  are  given 
for  several  different  aircraft  designs  graded  according  to  the  oonsequenoe  of 
loss  of  the  ACT  function.  The  failure  requirements  for  the  several  ACT  func- 
tions are  considered  minimum  in  each  case,  and  are  based  on  the  assumption  that 
only  that  ACT  function  is  involved.  In  reality,  it  is  difficult  to  visualize 
an  aircraft  designed  to  utilize  only  one  ACT  function;  where  more  than  one 
function  is  involved  it  is  obvious  that  the  more  stringent  redundanoy  require- 
ment would  prevail . It  should  be  noted  that  a failure  warning  is  given  to  the 
pilot  at  each  failure  level  to  meet  the  FAR  requirements.  It  is  assumed,  in  at 
least  some  oases,  that  the  operating  envelope  would  be  restricted  to  some 
defined  level  following  each  indicated  failure. 

An  aircraft  employing  a pure  fly-by-wire  control  system  (which  is  not  con- 
sidered to  be  an  ACT  application  per  se)  requires  extremely  high  reliability  in 
the  entire  flight  control  system*  Such  aircraft  will  likely  have  no  less  than 
two  f ail-opera te  redundancy  and,  as  such,  might  profitably  employ  ACT  appli- 
cations with  only  relatively  slight  increases  in  the  control  system  complexity. 
Once  the  commitment  is  made  to  inalterably  depend  upon  the  functioning  of  the 
sensors,  computers,  actuators  and  control  surfaces*  it  makes  little  difference 
to  safety  as  to  how  uncontrollable  or  structurally  sound  the  aircraft  is  without 
the  control  functions,  (in  such  cases,  restricting  the  operating  envelope  may 
be  moot.)  However,  it  is  in  such  oases  that  the  full  benefits  of  ACT,  in  terms 
of  reduced  direct  operating  cost  and  increased  return  on  investmient,  will  be 
realized. 


CORBEQHENCES  OP  MULTIPLICITY 


The  multiplicity  of  flight  control  components,  channels  and  power  sources 
to  achieve  the  operational  reliability  required  does  not  come  without  its  price. 
The  price  is  in  terms  of  equipment,  but  it  is  also  in  terms  of  pre-flight  tests 
to  establish  that  there  are  no  latent  failures  and  in  maintenance  action 
required  by  actual  failures  or  false  alarms.  An  STI  report,  "TPX  Handling 
Quality  and  Plight  Control  System  Study”  (AD  447909L)  published  in  August 
1965*  is  recommended  as  an  excellent  reference  which  "facilitates  tradeoffs 
between  potential  competing  mechanizations"  of  redundancy  in  automatic  flight 
control  systems.  Included  in  this  paper  is  a matrix  of  practical  redundant 
mechanizations  versus  major  operational  and  maintenance  qualities.  Prom  the 
data  given  it  is  evident,,  assuming  a control  surface  pulse  can  be  tolerated  as 
the  result  of  switching  after  a failure  is  detected,  that  an  active/standby 
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approaoh  offers  significant  reductions  in  the  probability  of  complete “faiTure 
as  compared  to  triple  channel  configurations.  Bren  more  impressiy®,  the  mean 
time  between  maintenance  actions  due  to  actual  failures  and  false  alairas  is 
reduced  by  an  crder  of  magnitude  (assuming  the  same  mean  time  between  failures 
for  like  components  in  each  case), 

!Ehe  use  of  split  surfaces  with  active/standby  actuator  redundancy  for  each 
offers  an  additional  feature,  namely  that  uninterrupted  operation  is  assured 
after  any  single  failure.  After  any  second  failure,  uninterrupted  operation  is 
also  assured  but  with  a one  in  three  chance  (or  less)  that  reduced  performance 
(authority)  will  result.  The  eventuality  of  a possible  lower  authority  after  a 
second  failure  may  be  accommodated  by  selecting  the  original  authorities  above 
actual  requirements,  adjusting  system  parameters  after  the  original  or  second 
fault  or  possibly  by  operational  restrictions  after  the  original  or  second 
fault. 


MULTIPLE  COmOL  SUEPACES 


The  use  of  multiple  control  surfaces  for  individual  axes  of  an  aircraft 
has  a long  history.  Trim  controls  that  are  separate  from  the  primary  maneu- 
vering controls,  for  example,  is  a concept  that  has  been  used  for  many  genera- 
tions; more  recently,  split  controls  such  as  upper  and  lower  rudders  and 
inboard  and  outboard  elevators  are  not  uncommon.  There  are  a variety  of 
reasons  why  multiple  control  surfaces  have  been  used  including  advantage  from 
consideration  of  auxiliary  power  demands,  operational  safety,  manufacturing 
costs  (particularly  on  large  aircraft),  and  flutter  characteristics,  in  addi- 
tion to  accommodating  the  flight  control  failure  tolerance  requirements.  V/hen 
used  for  failure  tolerance  reasons,  the  multiple  control  surfaces  in  any  axis 
must  be  sized  such  that  the  total  authority  exceeds  the  minimum  requirement  by 
some  margin.  Otherwise,  the  whole  philosophy  is  fallacious,  being  analogous  to 
a multi-engine  aircraft  in  which  the  loss  of  any  one  engine  results  in  an 
inability  to  continue  to  fly.  This  raises  the  question  of  what  is  the  minimum 
authority  required,  A quantitative  answer  is  strongly  dependent  upon  the  air- 
craft configuration  and  which,  if  any,  ACT  applications  are  involved.  Some 
general-trend  type  observations  can  be  made,  however,  which  bear  on  the  use  of 
split  surfaces  for  ACT, 

Consider  the  auxiliary  power  required  for  a flight  control  surface  servo 
or  actuator.  If  it  is  assumed  that  a constant  pressure  hydraulic  power  source 
is  used,  the  peak  power  supplied  is  simply  proportional  to  the  flow  demand. 

Power  supplied  = K Pg  Q, 

where  K is  a constant,  Pg  is  the  supply  pressure  and  Q,  is  the  flow  rate.  For  a 
given  stroke  actuator,  the  area  of  the  actuator  is  proportional  to  the  maximum 
hinge  moment  (assuming  the  acceleration  forces  are  small).  Plow  is  the  product 
of  actuator  area  times  rate,  or  proportional  to  actuator  area  times  surface 
rate.  Thus 

Power  supplied  = H 
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where  is  a new  oonataat;  is  the  maxinuffl  aorfaoe  rate  and  H%ax  is  the 
Imaximum  hinge  moment*  If  &»  is  a^roximatelj  the  frequency  (in  radians 

per  second)  at  which  the  control  surface  in  question  must  respond  with  some 
maximum  deflection  the  ^omr  supplied  expression  he  W3?itten  as 

(please  note  that  HHL„^  and  ^ typically  do  not  ooour  at  the  same  flight 
condition.)  ^ 

Qualitative  values  for  the  factors  in  this  expression  are  presented  in 
table  2 and  have  a number  of  implioations,  is  a reference  point,  the  ^bandpass" 
frequency  factor  ( to)  is  shown  as  ”low«  and  the  maximum  " control  power"  factor 
(^ma3^®*max)  ®^vn  as  "high”  for  i^e  basio  maneuvering  of  the  aircraft*  The 
corresponding  hydraulic  power  (p)  is  the  power  required  assuming  no  stability 
or  control  augmentation.  Designing  the  airoraf t with  relaxed  stability  and 
restoring  this  stability  with  augmentation  results  in  a higher  required  band- 
pass, althou^  the  authority  required  for  the  augmentation  funotion  may  be 
somewhat  lower  than  that  required  for  the  basic  maneuverability*  The  peak 
hydraulic  power  for  the  augmentation  funotion  alone  is  higher  than  that  for  the 
actuation  system  to  drive  the  baseline  control  surfaces*  In  many  current  air- 
craft, the  control  surfaces  for  these  functions  are  one  and  the  same,  with  the 
result  that  the  peak  hytoaulio  power  is  greater  than  the  reference  ”P.”  In 
view  of  the  power  requirements  (and  oompatability  of  bandpass  requirements),  it 
is  not  uncommon  that  relaxed  stability,  fatigue  life  improvement,  and  maneuver 
load  control  form  a set  of  AOT  functions  which  axe  considered  together. 

When  ride  quality  control  and  gust  load  alleviation  are  considered, partic- 
ularly where  the  higher  frequency  gusts  are  significant,  the  bandpass  and  peak 
hydraulic  power  requirements  are  considerably  Inoreased.  These  two  ACT  func- 
tions make  another  logical  set*  The  bandpass  requirements  for  flutter  mode 
controls,  except  for  isolated  or  specif iojMly  contrived  oases,  are  relatively 
very  hi^  with  the  result  that  this  ACT  application  stands  alone.  It  is  evi- 
dent that  gust  load  alleviation  and  ride  quality  control,  and  flutter  mode 
control  applioatiotts , are  pjime  candidates  for  dedicated  control  surfaces.  If 
a single  control  surface,  with  its  hi^  control  power,  were  used  for  basio 
maneuvering  and  for  an  ACT  funotion  with  a high  or  very  hl^  bandpass  require- 
ment, the  peak  hydraulic  power  demanto  for  the  actuators  would  be  extremely 
high.  As  indicated  by  the  control  powers  needed  for  the  ACT  functions  in  table 
2,  the  1186  of  smaller  or  partial  control  surface  authorities  can  meet  these 
needs,  minimize  the  hydraullo  power  required,  and  minimize  the  effects  of 
surface  pulses  or  even  a hard  over,  as  mi^t  result  in  a failure  or  multiple 
failure  condition* 

One  possible  flight  control  design  appjoaoh  suggested  by  multiple  control 
surface  considerations  wuld  utilize  a set  of  three-axis  multiple  control  sur- 
faces, with  the  possible  addition  of  direct  lift  and  side  force  controls,  for 
maneuvering  the  aireraft  either  by  the  pilot  or  autopilot*  Stability  ai^enta- 
tion,  maneuver  load  oontsol  and  fatigue  life  Improvement  functions  can  oonven- 
iently  use  ^rt  of  these  iBultiple  control  surfaces  ® The  servo  actuators  for 
those  sTJrfsoes  which  are  used  for  stability  augmentation  or  fatigue  life 
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Bandpass 

Control  Power 

Auxiliary 

Power 

Basic  Mbneuvering 

Low 

High 

P 

ACT  Function 

Relaxed  Stability 

Medium 

Medium 

>P 

^neuver  Load  Control 

Low 

Medium 

<P 

Gust  Load  Alleviation 

High 

Medium 

»P 

Flutter  Mode  Control 

Very  High 

Low 

»P 

Fatigue  Life  Improvement 

Medium 

Medium 

>P 

Ride  Quality  Control 

High 

Medium 

»P 
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improvement  require  a higher  bandpass  than  the  maneuvering  control  surfaces 
actuators.  But  by  using  only  a portion  of  the  maneuvering  controls  for  these 
purposes y the  hydraulic  po>/er  demands  are  significantly  reduced  compared  to  a 
non-multiple  surface  design. 

If  the  ACT  functions  of  ride  quality  control  and  gust  load  alleviation  are 
added,  they  might  also  use  portions  of  the  basic  maneuvering  control  surfaces 
but  separate,  ’'dedicated, " surfaces  located  more  optimumly  would  likely  be 
desirable  from  a system  weight  and  power  demand  standpoint.  The  desired  loca- 
tion and  required  high-frequency  response  of  control  surfaces  providing  flutter 
mode  control  will,  in  all  likelihood,  necessitate  separate  dedicated  surfaces 
for  this  ACT  function.  In  any  case,  the  possible  use  of  any  "dedicated"  con- 
trol surfaces  as  ultimate  backups  to  the  basic  maneuvering  controls  is  an 
attractive  possibility. 

The  "fullness  of  time"  for  ACT  applications  has  arrived.  Improved  aircraft 
efficiency  in  meaningful  measures  can  be  achieved  and  the  use  of  multiple  con- 
trol surfaces  can  contribute  significantly  to  this  achievement  without  compro- 
mising safety  or  creating  a "hanger  queen," 
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